# seekrit

> End-to-end encrypted, multi-tenant secrets manager on Cloudflare Workers. Secrets, private keys, and passphrases are encrypted on the client and never reach the server (zero-knowledge). Works from the browser, CLI, CI, containers, and AI agents.

seekrit is built to be driven by AI agents. The fastest way in: read the AI agents guide, then run `claude mcp add seekrit -- seekrit mcp` (or point any MCP client at `seekrit mcp`). Every page below is also available as markdown at the same URL with a `.md` suffix.

## Getting started

- [Introduction](https://seekrit.dev/docs.md): What seekrit is and the zero-knowledge model behind it.
- [Quickstart](https://seekrit.dev/docs/quickstart.md): Run the stack locally and encrypt your first secret.

## Concepts

- [Encryption model](https://seekrit.dev/docs/concepts/encryption.md): Envelope encryption: data keys, key wrapping, passphrase keys.
- [Architecture](https://seekrit.dev/docs/concepts/architecture.md): Orgs, apps, environments, and the Cloudflare building blocks.
- [Access & key grants](https://seekrit.dev/docs/concepts/access-control.md): Roles, per-principal key grants, revocation, and rotation.
- [Security model](https://seekrit.dev/docs/concepts/security.md): What the server can and cannot see; the threat model.

## Guides

- [Web dashboard](https://seekrit.dev/docs/guides/web-app.md): Sign in, set up keys, and manage secrets in the browser.
- [CLI](https://seekrit.dev/docs/guides/cli.md): Install, link a project, and inject secrets into any command.
- [seekrit-run launcher](https://seekrit.dev/docs/guides/run.md): Tiny static binary: inject secrets and exec, for CI and containers.
- [Environments & groups](https://seekrit.dev/docs/guides/environments.md): Share secrets with groups; layer .env and process env on top.
- [Service tokens](https://seekrit.dev/docs/guides/service-tokens.md): Machine credentials for CI, Docker, Kubernetes, and agents.
- [AI agents](https://seekrit.dev/docs/guides/ai-agents.md): Drive seekrit from Claude Code and other MCP clients over seekrit mcp.
- [CI/CD & containers](https://seekrit.dev/docs/guides/ci-cd.md): Wire seekrit into pipelines and image builds.

## Reference

- [CLI commands](https://seekrit.dev/docs/reference/cli.md): Every command, flag, and environment variable.
- [REST API](https://seekrit.dev/docs/reference/api.md): Endpoints, auth, and payloads exposed by the API worker.

## Optional

- [Full documentation, single file](https://seekrit.dev/llms-full.txt): every page concatenated