# mopac-keyproxy

A key-material proxy where the vault stays authoritative. Consumers receive
opaque placeholder keys; real secrets live only in Bitwarden Secrets Manager
and/or HashiCorp Vault and are resolved to real material at the wire, in
memory, never persisted, with no admin UI to attack.

- Placeholders in, real keys on the wire out (`mpk_...` refs; a leaked
  placeholder is revoke-and-remap, not an incident).
- Backends: Bitwarden Secrets Manager REST (machine accounts) and HashiCorp
  Vault KV v2 + AppRole. Stdlib-first; no Bitwarden SDK (license).
- Serves as both an HTTP hop and a CLI (`keyproxy get <ref>` for exec-style
  plumbing).
- AGPLv3. Part of the MOPAC family but standalone and composable: generic,
  config-driven, no organizational assumptions baked into code.

Status: specification phase (see MOPAC/harness/DESIGN.md, "Key proxy").
Building 2026-08-28 onward.