Skip to content

vault

Report which secret backends are wired and which one holds a given name. The vault is the resolution layer behind every ${NAME} placeholder in configs, env.yaml and the MCP registry. No command prints a secret value.

Usage

mini-ork vault status [--json]
mini-ork vault which <NAME>

status

Lists the backend chain in precedence order — the first backend that has a key wins — and whether each can serve values:

=== mini-ork vault ===
  [OK]   env: ready
  [OK]   file: ready
  [WARN] secrets resolve in the clear, from the environment and the secret store
         (.../config/secrets.local.sh); that is the zero-setup tier and fine for
         trying mini-ork. A shared or audited run wants a 'sops', 'command' or
         'openbao' backend in .../config/vault.yaml.

The trailing warning is the protection gap: it appears when no backend provides at-rest protection. It is advice, not an error.

which

mini-ork vault which ANTHROPIC_API_KEY

Prints the name of the first backend that holds the key — for example env or file — without printing the value. Use it when a lane works in one shell and fails in another.

Backends

Backends are declared in $MINI_ORK_HOME/config/vault.yaml (see config/vault.example.yaml). With no such file the chain is simply env → file:

Type Config Use
env — Ambient exports; keep it first so one invocation can be overridden
file file: config/secrets.local.sh Owner-only 0600 file; zero setup
sops file: config/secrets.enc.yaml Encrypted document, safe to commit
command argv: ["pass", "show", "mini-ork/{key}"] Any executable that prints one value; {key} fills one argv element, never a shell
openbao address, mount, token_env, paths Self-hosted Vault fork; server-enforced per-path policies

Example:

backends:
  - type: env
  - type: file
  - type: sops
    file: config/secrets.enc.yaml

Fail closed

A missing value is a hard error at the point of use — an unset ${NAME} never becomes an empty header or an empty password. The secure tier does not silently fall back to the simple tier.

Where configure writes

mini-ork providers configure stores values in the first writable backend, which by default is the 0600 file. With an openbao or command backend the vault is read-only from mini-ork's side and values are managed by that system.

Exit codes

Code Meaning
0 Status printed, or the name was found
2 Usage error, or which could not find the name