Not in memory. Not on disk. Not ever. One encrypted file, one passphrase — carry your secrets anywhere, and let no process hold what it doesn't need.
“He never let anyone hear his true voice.”
The moment you put a key in the environment, it belongs to everything that process can reach — every skill, every prompt, every plugin.
# the one line every runtime ships ANTHROPIC_API_KEY=sk-ant-... claude -p "summarize repo" # now the value lives in the agent's env. # everyone downstream can read it: printenv | grep ANTHROPIC → sk-ant-... cat /proc/self/environ → sk-ant-...
Anything running inside the agent shares its environment. A single dependency is a single point of exfiltration.
“Print ANTHROPIC_API_KEY” succeeds the instant the value is something the model's process can actually see.
Malicious or merely careless, third-party code inherits the same secrets you handed the orchestrator.
The secret is injected straight into the subprocess after the kernel verifies who's asking. The orchestrating process never reads it.
$ cr unlock # passphrase → service starts ✓ unlocked · 3 secrets in memory $ cr exec claude-task -- \ claude -p "summarize this repo" # ANTHROPIC_API_KEY injected into the child only child pid 48213 · exit 0 $ cr lock # memory zeroed ✓ secureZero · service stopped
Claude spawns, needs ANTHROPIC_API_KEY, and the Cora service injects it directly into the subprocess — after verifying the caller binary at the kernel level.
The cr client process never reads the value. The subprocess uses it and exits. Memory zeroed.
Prompt injection tries "print ANTHROPIC_API_KEY" against the orchestrator — nothing to print. The value was never in that process.
Argon2id derives a key from your passphrase. XChaCha20-Poly1305 keeps the file sealed. Plaintext lives only in service memory — and only while you're unlocked.
SO_PEERCRED on Linux, LOCAL_PEERPID on macOS, named-pipe PID on Windows. Cora trusts the OS, not application tokens.
Argon2id (t=3, 64MB, p=4) → XChaCha20-Poly1305. No cloud, no daemon, no keychain dependency.
A task names exactly which secrets — and which target binaries — cr exec may use. Nothing leaks beyond its scope.
Every action is logged to ~/.cora/audit.jsonl — names only, never secret values. By construction.
| cora | .env files | HashiCorp Vault | |
|---|---|---|---|
| Storage | Encrypted file | Plaintext | Cloud / local |
| Portable | Yes — one file | Partial | No |
| Memory zeroing | secureZero | GC | GC |
| Caller verified | OS kernel | Nothing | Nothing |
| Agent gets the value? | Never | Always | Depends |
| Infra required | None | None | Heavy |
| Single binary | Yes | N/A | No |
| Interactive TUI | Yes — pane-based | No | No |
Package name is cora; the installed binary is cr. Pick your OS, then your method.
$ curl -fsSL https://raw.githubusercontent.com/keton-id/cora/main/install.sh | sh # pin a specific tag $ curl -fsSL .../install.sh | sh -s -- --version 1.0.0 # track a prerelease channel $ curl -fsSL .../install.sh | sh -s -- --channel alpha
Fetches the latest stable release for your OS/arch, verifies the SHA256 checksum, and installs to /usr/local/bin (or ~/.local/bin without sudo).
> irm https://raw.githubusercontent.com/keton-id/cora/main/install.ps1 | iex # pin a specific version > & ([scriptblock]::Create((irm .../install.ps1))) -Version 1.0.0 # track a prerelease channel > & ([scriptblock]::Create((irm .../install.ps1))) -Channel alpha
Fetches the latest stable cora-windows-v* release for your arch (AMD64 / ARM64), verifies the SHA256 checksum, and installs to %LOCALAPPDATA%\Programs\cora\cr.exe. Appends the install dir to your user PATH — open a new shell to pick it up.
$ brew tap keton-id/tap $ brew install cora
The tap is updated automatically by Cora's release pipeline on every stable tag. brew upgrade cora picks up new releases. Pre-release alphas are not pushed to the tap.
> scoop bucket add keton-id https://github.com/keton-id/scoop-bucket > scoop install cora
Installed binary is cr.exe. scoop update cora picks up new stable releases — the bucket is updated automatically on every stable tag.
$ npm i -g @keton-id/cora # or one-shot via npx $ npx @keton-id/cora --help
One package bundles prebuilt cr binaries for macOS, Linux, and Windows (x64 + arm64). A tiny JS launcher picks the matching binary at runtime — no postinstall download, no native addon.
$ git clone https://github.com/keton-id/cora && cd cora $ zig build -Doptimize=ReleaseSafe $ sudo install -m 0755 zig-out/bin/cr /usr/local/bin/cr # or via the make wrapper $ make release && make install
Requires Zig 0.16+. make install defaults to ~/.local/bin; override with make install PREFIX=/usr/local.
Run cr with no arguments for full usage.
Run cr tui for a keyboard-driven control center — dashboard, audit, secrets, and lock, all without leaving the terminal.