Codex · Vardra workspace2 exact grants · connected locally
ActiveAgentic access control for macOS
Let agents act. Keep access under control.
Vardra brokers scoped, time-boxed secret access for named coding agents. Routine work can auto-allow; higher-risk requests stop for your approval; every decision stays locally auditable.
Named agentsScoped grantsLocal audit
Search agents, grants, and access events
Claude Code · Client delivery1 Ask-first grant · lease expired
ReviewCursor · Local sandboxNo grants · denied by default
BlockedExact capability
billing_test.api_key · executePolicy
Ask-first · 15 minutes · one useApprove onceDenyRevoke grant
The agentic access gap
Agents can act faster than access controls can keep up.
The problem is not where a password is stored. It is deciding which software identity may use a real credential, for what task, under what limits, with proof after the run.
The agent inherits a standing token
A credential meant for one task quietly becomes broad, reusable access with no expiry or attribution.
Every request gets the same answer
Blanket approval stops work; blanket permission removes control. Risk needs an explicit policy tier.
Nobody can prove what was used
After the run, shell history and model transcripts cannot establish which agent accessed which capability.
One local policy boundary
Govern access where agents actually work.
Native policy control
Approve only when risk requires it
Connect named agents, define exact grants, decide Ask-first requests, and revoke access from the same Mac.Apple-silicon macOS v0.1 targetCLI and MCP broker
Complete the task without revealing the value
Agents request a capability; Vardra executes inside a trusted local boundary and returns redacted task output.macOS and Linux v0.1 targetTrust boundary
The agent gets a capability. The model never gets the secret.
Vardra does not sell password storage. It gives agentic workflows a harder boundary: named identities, scoped grants, local policy decisions, immediate revocation, and no server-side vault key.
Read the security modelName the agent
Every local coding agent gets its own expiring identity instead of inheriting the operator’s authority.
Grant one capability
Bind an exact secret field, action, expiry, lease duration, use cap, and Auto-allow or Ask-first risk tier.
Broker the work
Authorized tasks use the credential inside Vardra’s trusted local executor; the model receives no raw value.
Audit and revoke
Review every request and decision by agent, then invalidate a grant or active lease before the next use.
Pricing
One professional plan for governed agent access.
MonthlyYearly save CA$58
Live now
Agent Access
CA$29/mo
- Named, scoped agent identities
- Auto-allow and Ask-first access policies
- Time-boxed grants with immediate revocation
- Local audit trail for every access decision
- Native macOS app, CLI, and MCP broker
- Unlimited secrets and local access requests
Objections answered
What operators need to know before trusting an access broker.
Is Vardra a password manager?
No. Vardra is an access broker for AI agents. It governs which named agent may use a secret, for which action, and for how long—without returning the raw value to the model.
Where do my secrets actually live?
The readable vault opens on your device. If sync is enabled, Vardra relays encrypted payloads that are useless without your local unlock material.
Can Vardra reset my master password?
No. That is the security boundary. Recovery has to come from material you control, not a support override that could open the vault.
Does this replace `.env` files?
For local development, that is the direction: keep canonical values in Vardra and inject only what a process needs. v0.1 starts with native vault and CLI/headless workflows; richer dev-tool guardrails graduate from there.
What happens if a device is lost?
Revoke that device from your account and continue from another paired device or your recovery material. A lost device does not give Vardra plaintext access.
Is this only a desktop app?
No. v0.1 pairs the native Apple-silicon macOS vault with retained command-line and Linux headless workflows.
Launch path