EXTENSIONS

HashiCorp Vault secrets management via REST API (KV v1 and v2). Emits OpenTelemetry spans for get, put, and list, with one child span per request in the recursive list walk, so vault reads are visible in traces including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and KV version only — never secret values, tokens, or error messages.

gopass password manager (gopass.pw) - pass compatible with extra features. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

GPG-encrypted password store using the pass CLI (passwordstore.org). Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and backend only — never secret values or error messages.

macOS Keychain vault using the security CLI. Emits OpenTelemetry spans for get, put, and list so vault reads are visible in traces, including reads during model and workflow runs where the host emits nothing. Span attributes carry the vault name, key name, and keychain service only — never secret values, argv, or error messages.

Read, write, and delete secrets stored in Azure Key Vault. Supports secret

Read, write, and delete secrets stored in AWS Secrets Manager, with support

Read, write, delete, and annotate secrets stored in 1Password using the `op` CLI.

Google Cloud vault infrastructure models

A swamp vault backend backed by Scaleway Secret Manager — source other models' secrets from Scaleway with vault.get(...) expressions, authenticated via X-Auth-Token.

OpenBao configuration rendering and API lifecycle control: render HCL, status, initialize, unseal, and seal. File deployment and service management are handled by cfgmgmt extensions.

A read-only swamp vault that mints a fresh Google OAuth access token on every

Self-signed TLS certificate generator for Swamp: creates RSA-4096 certs locally using node:crypto and stores cert + key in a swamp vault.

Passbolt CLI vault provider for swamp secrets

SOPS + age vault for swamp: encrypt secrets at rest with AES-256-GCM via Mozilla SOPS and age. Zero network dependency — fully local, file-based. Works with existing SOPS workflows and zo.space secrets dashboards.