Skip to content
adi
Website

Secrets

A secret is one KEY → value, encrypted at rest under ~/.adi/mono/secrets/, injected as an environment variable into an agent‘s runs. It’s either global (available everywhere) or filed under a project (overriding a global of the same name for that project’s runs). The list view only ever shows names and descriptions — a value crosses the wire solely on an explicit reveal, never on listing.

Why it exists

Section titled “Why it exists”

An agent that calls an external API needs a credential somewhere. Pasting it into a prompt or a tool’s source puts it in a transcript, a diff, a log. A secret is encrypted on disk, decrypted only into the environment of a run that was explicitly given it, and readable back out only by an explicit reveal (adi-mono secrets read NAME) — the list view shows names and descriptions only, never the value.

Do it

Section titled “Do it”

List: adi-mono secrets list. Panel: /extended/secrets.

Terminal window
adi-mono secrets set GITHUB_TOKEN --description "for the release tool"
adi-mono secrets read GITHUB_TOKEN     # the value-returning primitive; no --reveal flag

Attaching a secret to an agent is a separate, explicit step — see Agents#Nothing is on by default — done the same way as enabling a tool: tick it on that agent’s definition.

OAuth, without a cloud consoleEnterprise interest

Section titled “OAuth, without a cloud console”

A secret’s value can come from an OAuth flow instead of being typed in, so nobody handles a raw token by hand. On /extended/secrets, name the secret, switch its source to OAuth, pick a provider (Google today — Gmail read/send/manage scopes, or any other Google API; GitHub the same way), and authorize. No Google Cloud project or client credentials are needed on your side — the router already holds them, and the resulting token renews itself from its stored refresh token. Request the least scope that does the job.

Least privilegeExpert area

Section titled “Least privilege”

adi-mono secrets read (and the sys-secrets tool) returns any secret’s value to a shell-capable agent — enable that broadly only if you mean to. The tighter default is the per-agent allowlist: attach exactly the secrets a given agent needs, and only those arrive as env vars in its runs. A project secret shadowing a global of the same name is a feature, not a collision — name deliberately.