A native Mac vault for developer credentials, built toward letting coding agents run approved actions without ever seeing the secret. Today the vault is real, and human approval is tested only in a synthetic pilot.
Where it is
Notarized Mac vault; synthetic approval pilot
Form
Private product
Updated
2026-09-25
The idea
Coding agents can take on useful provider work, such as checking whether a build passed, but that work needs a credential. The usual answer is to paste a key into a prompt, a project file, or a configuration the agent can read, and from then on the agent holds the whole secret. Arcclave is for the individual developer who wants that help without making that trade.
When it works, the agent never asks for a key. It names the exact operation it needs, and Arcclave shows the developer the provider, the target, and what information would come back. One approval covers that one action and expires quickly. A trusted local adapter then runs the operation, and the agent receives only a bounded result. The bet is simple: the agent never needed the secret, only the outcome.
Today the vault underneath is real: a signed, notarized Mac app that keeps developer credentials encrypted, works on its own, and has no network access. The approval step has been shown only in a separate pilot on synthetic data, and the adapter that would run a real provider operation is not built yet.
How it works
Encrypted vault
Agent request
One-time human approval
Bounded result (synthetic today)
Three planes of one product. Custody: a sandboxed SwiftUI app with an in-process, statically linked Rust cryptographic and storage core and no network entitlement. Authorization: a separately signed pilot app, per-user XPC relay, and MCP stdio connector that never link the vault. Execution: a trusted local adapter that would run the approved operation and return a sanitized result; it is not built.
Where it stands today
The installed app is a Developer ID signed and notarized macOS vault (1.2 build 6), sandboxed with no network entitlement and accepted by its owner. A separately signed pilot app, relay, and MCP connector demonstrates one-time human approval of a single CI-status request on synthetic fixtures, and it never links the vault. No real provider operation exists, and agents cannot reach real credentials.
Working now
Encrypted local vault for logins, API keys, and secure notes
Native SwiftUI app with a statically linked Rust core and no network entitlement
Encrypted backup, restore, and .env import
Developer ID notarized arm64 build, installed and owner-accepted
Signed approval pilot on synthetic fixtures: approve, deny, expiry, and cancellation verified
Not there yet
Attended Touch ID enrollment-change, sleep, and screen-lock checks, a full accessibility review, and deeper fuzzing and fault injection remain open.
How it got here
Started as a local-only Mac password and developer-secrets manager with a Rust encryption core and no network access
Redesigned with separate production, test, and pilot identities; a synthetic agent-approval pilot began
Notarized production build installed and owner-accepted; the signed pilot's approve, deny, expiry, and cancellation paths verified
Thesis crystallized as a local, human-controlled capability broker for developer agents, with the private vault underneath; named Arcclave, and a landing page built
What comes next
Next step
Plan and prove the visible rename to Arcclave in the test build, then complete the attended Touch ID, sleep, and screen-lock checks.
After that
Explore human-approved, operation-scoped credential use for coding agents through a trusted local adapter
Rename the visible app to Arcclave in a test build first, keeping existing vaults and backups working
Review one narrow real provider action, such as a private-repository CI-status read, under a new threat model before any real use
Move the approval pilot to the new name as one coordinated protocol generation
Proof and fine print
Dated evidence
No network or automation surface observedsecurity
Production 1.2 notarized, installed, and owner-acceptednotarization
Synthetic approval pilot: approve, deny, expiry, and cancellation verifiedpilot
Build and test run passed on macOS 14ci
Public name changed to Arcclave; landing page built, not yet deployednaming
Installed build re-verified against the notarized archivenotarization
Boundaries it keeps
No real provider operation exists; the pilot uses synthetic fixtures only
Agents do not receive real vault secrets, and the pilot never links the vault
Not publicly released; the repository and landing page are private
Not a consumer password-manager replacement: no browser autofill, passkeys, sync, or sharing
Christian's role
Set the product thesis and the naming decision; designed the native and Rust boundary and the approval threat model; directed the signing, notarization, and security checks, and reviewed and tested the implementation.