Secrets management for humans and agents
NiSTAR (Hebrew: נִסְתָּר — "hidden") is a self-hosted vault built for the reality of 2026: your AI agents need credentials to work — and neither your security posture nor the models themselves tolerate secrets in prompts. NiSTAR gives people a full vault, gives agents a governed access plane, and keeps raw keys out of every conversation.
One door · humans and agents
THE PROBLEM IT SOLVES
Your automation needs credentials — deploy keys, database passwords, API tokens, SSH access. The 2015 answer was a .env file. The 2020 answer was a SaaS vault. The 2026 problem is new: the worker is now an AI agent, and AI agents don't just need secrets — the newest frontier models actively refuse to touch them. Recent OpenAI GPT-6-family models ship with default security gates that reject keys, passwords, and other secrets found in prompts, and refuse to read credentials from local files. The refusal is reasonable — models are finally treating secrets as toxic — but the side effect is brutal: every credential-driven agent task, from deploys to database maintenance, simply gets blocked. Your agent stares at the locked door you hired it to open.
Pasting secrets into agent prompts was always the wrong shape anyway: once a key enters a prompt it lands in context windows, logs, traces, and provider retention — a breach with extra steps. NiSTAR is the missing piece on both sides of that wall: the agent's context stays secrets-free, so modern models stay compliant and willing, and the credential never leaves a governed, audited, revocable vault. The agent asks for capability; NiSTAR answers with an action — not a key.
HOW AGENTS WORK WITH IT
Every vault item carries a sensitivity tier that decides what a human sees, what an agent may do, and what never leaves the vault at all:
| Tier | Human | AI agent |
|---|---|---|
| public | Full read | Full read |
| internal | Full read | Full read — still audited |
| confirm | Read; can approve others | Use requires a human approval — approval-gated release |
| broker | Read | Never sees the secret. Gets an opaque handle; a broker container performs the actual use (SSH, HTTP) on the agent's behalf |
| never_ai | Read | Refused. Structurally unreachable — the tier exists so you can say "no" with a schema, not with hope |
The agent-facing surface is a native MCP server (Streamable HTTP and stdio) plus a broker dispatch API. For humans there's a full web UI — folders, versions, live TOTP codes, one-click copy with audit — and a CLI: nistar run --env DB=item -- ./deploy.sh injects tier-aware values into a child process without ever exposing broker-tier secrets to the shell history.
WHAT'S INSIDE
A real vault. Typed items — secrets, secure memos, certificates, SSH key pairs, RAssist links, OTP — with full version history and change reasons, hierarchical folders, project-scoped RBAC with fail-closed auditing, and per-user notification channels (SMTP/Telegram) with live SSE updates.
A relations graph with blast radius. Every credential is a node in a typed graph of entities, owners, and consumers. Before you rotate a key or retire a service account, NiSTAR shows you directional blast radius — hop distance, direction, full-reach summary — so "what breaks if I rotate this" is a click, not an incident. It doubles as your identity-lineage map: which identities hold which secrets, stored where, consumed by what.
A bundled internal CA. Multi-CA X.509 authority with CSR issuance, signed CRLs, auto-renewal, and ACME (RFC 8555) + EST (RFC 7030) servers — it issues the mTLS workload identities that brokers and remote agents authenticate with, and covers general corporate certificate needs. One Compose stack: secrets and the identities that consume them. Certificate expiry participates in the blast-radius graph.
Tamper-evident everything. Every access, reveal, approval, and change lands in a hash-chained audit log — exportable and independently verifiable. Prometheus metrics and structured logging ship in the box.
Open integrations. Remote agents on the agentkit pattern: a GLPI collector pushes fleet inventory into the relations graph; a Bitwarden mirror agent brings shared collections in. Your existing secret sources stop being silos.
WHY SELF-HOSTED, WHY NOW
Secrets infrastructure is the last place you want a per-seat SaaS meter or a vendor's retention policy between your keys and your agents. NiSTAR deploys as a single Docker Compose stack on your infrastructure — no unseal ceremony, no Shamir ritual, no operational weight. And unlike classic vaults, its access model was designed for non-human actors from day one: scoped short-lived tokens, brokered single-use release, and tiers that make "the model can hold a reference, never a key" the default rather than a policy memo. It's the same software that guards our own fleet — including the brokers and PKI that issue its own workload identities.
TRY THE LIVE DEMO
https://nistar-demo.codyssey.com — a public demo seeded with a fictional mid-size company: 2,180 vault items across 405 workstations, 2,070 credential links, live brokers, and a GLPI-fed inventory graph. It resets nightly and pulls the newest build every cycle, so what you see is what we run.
Username and password are always required. TOTP is the second factor — mandatory on every demo account, not an alternative to the password. The QR codes below are a convenience: scan once to enroll the authenticator instead of typing a 32-character secret, then log in with the password and the rolling 6-digit code. NiSTAR also supports passkeys natively for fully automated, passwordless sign-in — try it once you're in. The enrollment secrets are published here on purpose: the demo corpus is fiction, and it resets nightly and on every application update. Do not reuse anywhere real.
click QR to copy secret
secret copied ✓click QR to copy secret
secret copied ✓click QR to copy secret
secret copied ✓DOCUMENTATION
Complete user and administrator documentation is published at docs.codyssey.com/nistar:
- User Guide — vault concepts, item lifecycle, approvals, relations & blast radius, CLI, and MCP client workflows.
- CLI & agent workflows — the
nistarCLI and AI-agent usage patterns. - Connecting an MCP client — onboarding Claude, VS Code, Cursor, or any MCP host.
- Administrator Guide — deployment, RBAC, key custody, agents & broker, PKI, audit, monitoring, hardening.
- Agents, MCP & broker operations — the operator view of the agent access plane.
- Runbooks — incident, rotation, backup, and review procedures.
- CLI Reference —
nistarsyntax, fields, limits, and exit codes.
Agents act. Credentials don't leak.
If your agent workflows are stalling on credential gates — or your keys are one prompt away from a log file — let's walk through your stack. We deploy NiSTAR, wire the broker into your tooling, and hand over the keys. Figuratively.