v0.2.0

A FUSE-based, zero-trust credential protection system that stops AI agents and other processes from exfiltrating API keys, AKSK, private keys, passwords, and other identity credentials — without changing how applications read their files.

Key features

• No plaintext on disk — credentials are AES-256-GCM encrypted under master.key; the original file becomes a symlink, so plaintext never touches disk.
• Transparent FUSE mount — credentials stay at their original path, so ssh, git, psql, kubectl, aliyun need zero application changes.
• Per-process attestation on every open() — UID/permission, binary allowlist + SHA256 measurement, open-count limit, cmdline-tamper detection (eBPF / auditd), and a security-check bundle. Unauthorized callers get a plain EACCES.
• Static binaries — Linux build is statically linked, runs across distributions without glibc-matching concerns.
• One-command install — INSTALL / UNINSTALL cover Linux (systemd) and macOS (launchd): binaries, config, service unit, reload.

Platforms

Linux x86_64 and macOS (universal). eBPF cmdline attestation needs Linux ≥ 5.2 with BTF; otherwise it falls back to auditd, then to plain /proc. macOS has no eBPF.

Quick start

tar xzf credagent_0.2.0_linux_amd64.tar.gz && cd credagent_0.2.0_linux_amd64
sudo ./INSTALL
sudo credagent init --config /usr/local/etc/credagent/engine/config.json
sudo systemctl enable --now credagent

Unattended / cloud-image: add --auto-init to the service ExecStart to bootstrap a master key and a random admin password on first boot.