mopac-keyproxy/README.md

mopac-keyproxy

A key-material proxy where the vault stays authoritative. Consumers receive opaque placeholder keys; real secrets live only in Bitwarden Secrets Manager and/or HashiCorp Vault and are resolved to real material at the wire, in memory, never persisted, with no admin UI to attack.

• Placeholders in, real keys on the wire out (mpk_... refs; a leaked placeholder is revoke-and-remap, not an incident).
• Backends: Bitwarden Secrets Manager REST (machine accounts) and HashiCorp Vault KV v2 + AppRole. Stdlib-first; no Bitwarden SDK (license).
• Serves as both an HTTP hop and a CLI (keyproxy get <ref> for exec-style plumbing).
• AGPLv3. Part of the MOPAC family but standalone and composable: generic, config-driven, no organizational assumptions baked into code.

Status: specification phase (see MOPAC/harness/DESIGN.md, "Key proxy"). Building 2026-08-28 onward.