🛡️ SecretForge AI

Stop Committing API Keys Forever

One command. Zero exposed secrets.

Get Started • Documentation • Discord • Twitter

⚡ What is SecretForge?

SecretForge AI is an AI-powered secret management platform that automatically:

• 🔍 Detects required API keys from your project dependencies
• 🔐 Provisions secure keys with optimal scopes
• 🔄 Rotates keys based on AI-powered schedules
• 🛡️ Catches exposed secrets in PRs before they hit production
• ✅ Validates compliance (SOC2, GDPR, HIPAA, PCI-DSS)

Built with: Cloudflare Workers + AI Agents + Model Context Protocol

Features

• 🤖 AI-Powered Detection: Automatically detects required API services from project dependencies
• 🔐 Zero-Config Provisioning: Intelligent key generation with minimal configuration
• 🔄 Automatic Rotation: Scheduled and policy-based key rotation
• ✅ Compliance Validation: SOC2, GDPR, HIPAA, PCI-DSS compliance checking
• 🌍 Edge-Native: Built on Cloudflare Workers for global low-latency
• 💬 Natural Language Interface: Chat with AI assistant via CLI or web dashboard
• 📚 Documentation Search: Vector-based semantic search for API documentation
• 🔍 MCP Integration: Seamless integration with Claude Code and MCP-compatible AI tools

Architecture

┌─────────────────────────────────────────────────────────────┐
│                     SecretForge AI                          │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐     │
│  │  MCP Server  │  │     CLI      │  │  Web Dashboard│     │
│  │  (Claude)    │  │   (Ollama)   │  │   (Next.js)   │     │
│  └──────┬───────┘  └──────┬───────┘  └──────┬────────┘     │
│         │                 │                 │              │
│         └─────────────────┴─────────────────┘              │
│                           │                                │
│                  ┌────────▼────────┐                       │
│                  │  Cloudflare API  │                       │
│                  │  (Hono/Workers)  │                       │
│                  └────────┬─────────┘                       │
│                           │                                │
│         ┌─────────────────┼─────────────────┐              │
│         │                 │                 │              │
│    ┌────▼────┐      ┌─────▼─────┐     ┌────▼─────┐        │
│    │   D1    │      │    KV     │     │Vectorize │        │
│    │(SQLite) │      │(Secrets)  │     │  (Docs)  │        │
│    └─────────┘      └───────────┘     └──────────┘        │
│                                                             │
│    ┌──────────────────────────────────────────┐            │
│    │      Cloudflare Agents (Stateful AI)     │            │
│    │   GPT-4o • Embedded SQLite • State Mgmt  │            │
│    └──────────────────────────────────────────┘            │
└─────────────────────────────────────────────────────────────┘

Quick Start

Prerequisites

• Node.js 20+
• pnpm 8+
• Cloudflare Account (for deployment)
• Ollama (optional, for local CLI AI)
• OpenAI/Anthropic API Keys (for AI features)

Installation

# Clone the repository
git clone https://github.com/yourusername/secretforge-ai.git
cd secretforge-ai

# Install dependencies
pnpm install

# Copy environment template
cp .env.example .env

# Configure environment variables
# Edit .env with your API keys

# Run setup script
bash setup.sh

Development

# Start all services
pnpm dev

# Start specific package
pnpm --filter @secretforge/cli dev
pnpm --filter @secretforge/api dev
pnpm --filter @secretforge/web dev

# Build all packages
pnpm build

# Run tests
pnpm test

# Lint
pnpm lint

Using Docker Compose

# Start all services (Ollama, Miniflare, PostgreSQL, Redis)
docker-compose up -d

# View logs
docker-compose logs -f

# Stop services
docker-compose down

Project Structure

secretforge-ai/
├── packages/
│   ├── api/              # Cloudflare Workers API
│   │   ├── src/
│   │   │   └── index.ts  # Hono API, Agents, endpoints
│   │   ├── schema.sql    # D1 database schema
│   │   └── wrangler.toml # Cloudflare configuration
│   │
│   ├── cli/              # Command-line interface
│   │   └── src/
│   │       └── index.ts  # Commander CLI, Ollama integration
│   │
│   ├── mcp-server/       # Model Context Protocol server
│   │   └── src/
│   │       └── index.ts  # MCP tools & prompts
│   │
│   ├── web/              # Next.js dashboard
│   │   └── app/
│   │       └── page.tsx  # React UI
│   │
│   └── shared/           # Shared utilities (future)
│
├── .github/              # CI/CD workflows
├── docs/                 # Documentation
├── infrastructure/       # IaC configs
├── docker-compose.yml    # Local development environment
├── turbo.json            # Turborepo configuration
└── package.json          # Monorepo root

Usage

CLI

# Initialize project
secretforge init

# Request API key
secretforge request stripe --env prod --scopes read_write

# Rotate existing key
secretforge rotate secret-id-123

# List all keys
secretforge list

# Chat with AI assistant
secretforge chat "How do I rotate my Stripe keys?"

MCP Server (Claude Code)

Add to your Claude Code MCP settings:

{
  "mcpServers": {
    "secretforge": {
      "command": "npx",
      "args": ["-y", "@secretforge/mcp-server"]
    }
  }
}

Use in Claude:

• "Analyze my project and detect required API keys"
• "Provision a Stripe API key for production"
• "Validate my secrets for SOC2 compliance"

Web Dashboard

cd packages/web
pnpm dev

Visit http://localhost:3000 to access the dashboard.

Configuration

Cloudflare Setup

# Login to Cloudflare
pnpm wrangler login

# Create D1 database
pnpm wrangler d1 create secretforge-db

# Apply schema
pnpm wrangler d1 execute secretforge-db --file=packages/api/schema.sql

# Create KV namespace
pnpm wrangler kv:namespace create SECRETS_VAULT

# Create Vectorize index
pnpm wrangler vectorize create api-docs-index --dimensions=1536 --metric=cosine

# Deploy
pnpm --filter @secretforge/api deploy

Environment Variables

See .env.example for full list. Key variables:

• OPENAI_API_KEY: OpenAI API key for embeddings & AI
• ANTHROPIC_API_KEY: Anthropic API key for Claude
• ENCRYPTION_KEY: 32-byte encryption key (generate with openssl rand -base64 32)
• SECRETFORGE_API: API endpoint URL

Security

• Encryption: AES-GCM 256-bit encryption for all secrets at rest
• Zero-Knowledge: Secrets encrypted before storage, decrypted on-demand
• Audit Logging: All operations logged with IP, user agent, timestamp
• Compliance: Built-in validation for SOC2, GDPR, HIPAA, PCI-DSS
• Rotation Policies: Configurable automatic rotation schedules

Tech Stack

Roadmap

• OAuth2 integration for major providers
• Browser extension for 1-click key injection
• Slack/Discord bot for ChatOps
• Terraform/Pulumi provider
• GitHub Actions integration
• Key usage analytics & anomaly detection
• Multi-tenant support
• SSO/SAML for enterprise

Contributing

Contributions welcome! Please read CONTRIBUTING.md first.

# Fork the repo
git checkout -b feature/your-feature

# Make changes and test
pnpm test

# Commit and push
git commit -m "Add your feature"
git push origin feature/your-feature

# Open a pull request

License

MIT License - see LICENSE for details.

Support

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Email: support@secretforge.ai

Acknowledgments

Built with:

• Cloudflare Workers
• Model Context Protocol
• Anthropic Claude
• OpenAI
• Ollama

Made with ❤️ by the SecretForge team