Sepulchre
- TypeScript
- Hono
- Astro
- MCP SDK
- Zod
- HashiCorp Vault
- OIDC / JOSE
- Argon2
- Hash-chained audit
- PostgreSQL
- Drizzle ORM
- PgBouncer
- MinIO (S3 WORM)
- Turborepo
- Docker
- Kubernetes
- Terraform
- Ansible
- Traefik
- Prometheus
- Cloudflare Pages
“Don't trust us. Verify us.”
A credential broker for the secrets that pass between people. The operator who runs it can't read what flows through it: an explicit Vault deny policy blocks access no matter what other permissions exist. A script you can run yourself checks that promise against the live system.
- Zero-knowledge operator access
- Hash-chained signed audit trail
- BYOK per-tenant encryption
- Human approval for AI agent readers






















