EXTENSIONS

gopass password manager (gopass.pw) - pass compatible with extra features

HashiCorp Vault secrets management via REST API (KV v1 and v2)

GPG-encrypted password store using the pass CLI (passwordstore.org)

macOS Keychain vault using the security CLI

Read, write, and delete secrets stored in Azure Key Vault. Supports secret

Read, write, and delete secrets stored in AWS Secrets Manager, with support

Read, write, delete, and annotate secrets stored in 1Password using the `op` CLI.

Manage a Scaleway Secret Manager secret — sync/create/update/delete metadata, list secrets in a region, add new secret versions, and access secret values (returned only via a sensitive, vaulted output), via the Secret Manager API with X-Auth-Token auth.

OpenBao configuration rendering and API lifecycle control: render HCL, status, initialize, unseal, and seal. File deployment and service management are handled by cfgmgmt extensions.

Vaultwarden helper model for environment template discovery/rendering and HTTP health verification. Deployment and service management are handled by cfgmgmt extensions.

Snowflake warehouses, databases, schemas, stages, tasks, pipes, secrets, and grants as Swamp models. Compose Snowflake pipelines with non-Snowflake resources in Swamp workflows. Backed by the Snowflake SQL Statement Execution API (v2).

GitHub Actions secret management via the local gh CLI. Supports repo-level, environment-scoped, and organization-scoped secrets with fan-out, code-search discovery, and a dry-run mode on the org-level setter. No PAT, GitHub App, or vault-held token required — auth comes from the operator's existing gh session.

Databricks Jobs, DLT pipelines, SQL warehouses, workspace notebooks/files, secrets, Unity Catalog, permissions, DBSQL queries, and Git Repos as Swamp models. Compose Databricks pipelines with non-Databricks resources in Swamp workflows.

Passbolt CLI vault provider for swamp secrets

SOPS + age vault for swamp: encrypt secrets at rest with AES-256-GCM via Mozilla SOPS and age. Zero network dependency — fully local, file-based. Works with existing SOPS workflows and zo.space secrets dashboards.