Really cool idea. Skimmed the writeup, but none of this is emulated???
4 karma · joined June 3, 2012
I also decided to embrace .env because that's how humans (and apparently agents -- for now) like to work when building stuff. Except Capy is the only solution I know of that allows you to cryptographically revoke access to those .env files in real time.
Regarding the MCP, watch this space: https://www.capy.sc/
For portability your secrets in those platforms can't move around with you, but with Capy they can move with you wherever you're doing your work. Your local machine, your sandbox, etc.
Capy also helps you deploy your secrets into Coder, Claude, Copilot and whatever other Clever product you prefer to use ;)
For ergonomics, Capy is built from the ground up as a CLI, which means it's extremely flexible in where you want to use it. I'm also working currently on making it work SUPER well in agentic coding workflows. There's going to be more on that coming soon!
All the security and logical primitives are enforced via the CLI's command layout, similar to how it is done with git, and the human is still in the loop for the most critical stuff like initial onboarding, saving secrets, resolving conflicts, running deployments, and performing rotations.
I do eventually want to find safe ways for agents to take over those tasks, and there is a lot to learn from how software factory agents currently work with git. The thing is, even with software factories, the VERSION CONTROL gates are also usually still defined by humans (when to commit, merge, deploy, etc.). Whatever it is, the same level of automation ought to exist for secrets and configuration.
To that end, I have an upcoming MCP that acts as a wrapper for orchestrating sequences of Capy CLI commands (but never the contents of them). In the preliminary MCP implementation there's nothing the agent is actually able to interpret, besides maybe identifying variable names, what the stack looks like, and what services the application likely uses.
See CC6.2 Creation and Removal of User Credentials and CC6.6 External Protections, but if you don't work in a regulated environment, world's your oyster!
On the controls side, SAST scanning in CI, and minimizing deps as much as possible in the client and the service.
Not sure how to describe this, but it's almost like the product gives you the false impression that you're done setting it up when there's still things like security rules that you need to learn and know about.
You can read more about it here: https://www.capy.sc/docs/internals/zero-trust
In addition, the company is right around the corner on our SOC2 Type I audit. It should be available within the next week!
My question would be where you think this space is moving next? I have my own hypotheses but before sharing I'd love to hear your thoughts!
IMO that's still "tech moat" thinking. The real moat nowadays is GTM traction, and "creativity/taste". All software can be copied, but the creation of new concepts/solutions and trends, is still uniquely something that requires a deep understanding of the "WHYs" and "HOWs" as I've described in my writing.
I've always been curious how products like ag-grid are able to allow you to lazy-load 10,000,000+ rows in a table without the blanking you described, and I imagine this type of method describes how it can be done.