Built to be unseen.
Shroud is a terminal layer for AI coding agents. Secrets become references; plaintext resolves only at execution, under scoped UCAN + DID capabilities — never inside model context.
a recorded session — secrets never reach the model
Reference. Authorize. Resolve.
The agent never needs the literal key — it needs the authority to use the key for a bounded purpose. Shroud turns that authority into a local, auditable runtime protocol.
Agents see references
Environment files and commands carry stable symbolic references instead of secret values.
Access is scoped
You grant secret/read to an ephemeral agent DID — one resource, one bounded time window.
Plaintext only at exec
The shim resolves references after the command is emitted, injects into the child process, and journals it.
Three leak paths. One boundary.
Coding agents leak through file reads, environment inspection, and command output. Shroud narrows all three to symbolic handles — the model gets a reference, the value stays in the vault until the moment of execution.
cat .env reads a reference, not a key.
printenv shows handles; injection happens post-fork.
The proxy redacts echoes and raises an audit event.
Small primitives. Hard boundary.
Shroud is intentionally narrow: keep secrets local, expose references, authorize resolution, and leave a trail.
Each agent gets a leash.
Every session receives an ephemeral DID and only the UCAN scopes you approve.
attenuation only narrows — sub-agents can hold less authority than their parent, never more
Every resolution, journaled.
Hash-chained · tamper-evident · shroud audit
Nothing leaves your machine.
Secrets stay encrypted at rest in ~/.shroud/vault.age, held in locked memory during a session. Hardware-backed keys where available.
Names, never values.
Agents operate on $SHROUD_REF(STRIPE_KEY) — stable across rotations, useless in a transcript.
One command, instant.
shroud revoke kills a capability by CID. Fail-closed — no rotating the key across every service.
Capability-mediated terminals for AI agents.
The full technical draft: threat model, cryptographic foundations, the Shroud protocol, reference implementation, residual risks, and evaluation across 47 agent workflows.
Questions, answered.
The short version of what people ask first. The whitepaper covers the rest in depth.
Contact usDoes my agent need to change?
No. Claude Code, Codex, Cursor, Aider and other agents run unmodified. Shroud wraps the terminal session — agents simply see references instead of values.
Where do my secrets live?
In an encrypted local vault on your machine (~/.shroud/vault.age), unlocked per session and held in locked memory. No secret ever leaves your machine.
What if a tool genuinely needs the key?
It gets it — at execution time. The shim injects plaintext into the child process after fork, before exec. The agent and the model context never hold it.
Can I see what was accessed?
Every resolution, denial, and revocation is appended to a hash-chained local journal. shroud audit shows you exactly what happened, when, under which capability.
What happens when I revoke?
shroud revoke invalidates the capability by CID instantly. The next resolution attempt fails closed — no rotation scramble across every service.
Give your AI the work.
Keep the secret unseen.
Early builds are shared manually with setup help. No public download yet.