EXTENSIONS

A swamp vault on AWS Systems Manager Parameter Store. Every secret is a SecureString parameter, on the Standard tier, named by a prefix (default /swamp/) and the secret key. Credentials come from the AWS default chain or a named profile; an optional KMS key encrypts the values. get, put and delete refuse plaintext String parameters, delete is immediate, and errors never carry the value. Supports swamp vault read-secret, put, list-keys and delete.

Swamp vault backed by a running KeePassXC, reached through its Browser

Read, write, and delete secrets stored in AWS Secrets Manager, with support

Read, write, and delete secrets stored in Google Cloud Secret Manager, with

Read, write, and delete secrets stored in Azure Key Vault. Supports secret

Read, write, delete, and annotate secrets stored in 1Password using the `op` CLI.

Probe the credentials a fleet actually holds and report how long each has left, distinguishing expiry from an outage in progress

GPG-encrypted password store using the pass CLI (passwordstore.org). Can return just the first line of a multiline entry (the password, by pass convention) or a named metadata field such as login. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key and field names, and backend only — never secret values or error messages.

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

Griptape Cloud Secrets — organization secret management

SOPS + age vault for swamp: one encrypted file per secret.

Manage a Scaleway Secret Manager secret — sync/create/update/delete metadata, list secrets in a region, add new secret versions, and access secret values (returned only via a sensitive, vaulted output), via the Secret Manager API with X-Auth-Token auth.

A swamp vault backend for 1Password Connect — read and write secrets over Connect's HTTP API with a bearer token, so vault.get() works headless in cron, containers, and swamp serve without the op CLI.

TPM 2.0-backed non-exportable OpenPGP key via tpm2-pkcs11 + gnupg-pkcs11-scd; presents a ready GNUPGHOME for a pass vault (generate/unlock/status/revoke).

OpenBao configuration rendering and API lifecycle control: render HCL, status, initialize, unseal, and seal. File deployment and service management are handled by cfgmgmt extensions.

Vaultwarden helper model for environment template discovery/rendering and HTTP health verification. Deployment and service management are handled by cfgmgmt extensions.

Snowflake warehouses, databases, schemas, stages, tasks, pipes, secrets, and grants as Swamp models. Compose Snowflake pipelines with non-Snowflake resources in Swamp workflows. Backed by the Snowflake SQL Statement Execution API (v2).

Databricks Jobs, DLT pipelines, SQL warehouses, workspace notebooks/files, secrets, Unity Catalog, permissions, DBSQL queries, and Git Repos as Swamp models. Compose Databricks pipelines with non-Databricks resources in Swamp workflows.

Passbolt CLI vault provider for swamp secrets

SOPS + age vault for swamp: encrypt secrets at rest with AES-256-GCM via Mozilla SOPS and age. Zero network dependency — fully local, file-based. Works with existing SOPS workflows and zo.space secrets dashboards.