Skip to content

Blackbook Secrets Engine

The utmost in paranoid security.

A self-hosted, open-source secrets manager written in Rust. An end-to-end-encrypted alternative to HashiCorp Vault for API keys, passwords, tokens, certificates, and files. Deploy it with Docker; drive it from the bbk CLI, a local web console, or AI agents over MCP.

Get started How it works View on GitHub

docker compose up -d                   # start the server
bbk put api-key "sk_live_abc123"       # save a secret
bbk get api-key                        # read it back
bbk file put ./id_rsa --name ssh-key   # save a file

All you need is Docker: bbk runs from the same image, with nothing to compile (Quick start). Prefer a native binary? cargo install blackbook.

Secure by default, not by configuration

There's no "secure mode" to switch on, because there's no insecure mode to begin with. Every one of these is on out of the box:

  • Encrypted in transit

    TLS 1.3 only, with mandatory mutual TLS. Every request must present both a client certificate and a token, and both must belong to the same identity.

  • Encrypted at rest, names included

    Values and identifiers (secret names, users, groups, audit messages) are encrypted. A stolen database dump is just noise.

  • Fine-grained access control

    Private and shared domains, group rules, time windows, and use caps that count down and stop authorizing on their own.

  • Tamper-evident audit log

    Every action is logged in a keyed hash chain, so deleting, editing, or reordering history is detectable with bbk audit --verify.

  • Read-only by default

    Saving over an existing secret is refused. Overwriting is a separate, deliberate action, so nothing important gets silently clobbered.

  • Your saved login is sealed too

    Credentials on your own machine are encrypted under an Argon2id-derived key. A copied ~/.bbk folder is inert without your passphrase.

Turn the dial up when a secret deserves it

  • Two-person rule

    Require K of N named teammates to approve before anyone can read a secret.

    K-of-N approvals

  • MFA on every read

    Demand a fresh TOTP code from any authenticator app for each read of a flagged secret.

    Two-factor reads

  • Even the server can't read it

    --external encrypts on your machine first. The server stores ciphertext it has no way to open.

    Client-side encryption

  • Burn after reading

    Self-destruct after one read, cap the number of reads, or make a secret permanently immutable.

    Per-secret protections

  • Built for AI agents

    bbk mcp gives Claude Code and other MCP clients least-privilege, server-enforced access to secrets.

    AI agents (MCP)

  • End-to-end-encrypted tunnels

    ssh -L-style port forwarding between two clients, relayed by a server that only ever sees ciphertext.

    Secure tunnels

Explore the docs