韩文

代理钱包。 持有证书——代理人在不见的情况下使用.

npm install @daslabhq/kern

与Node.js 18+和 阿宝. . CLI 需要 Bun. .

问题

探员需要API密钥. 今天,生活在阴道中的人——简洁的、没有观察的、每个过程都能看到一切。 给Frede打电话的特工 上下文窗口里有你的制作密钥 每一个证书都是从过滤中迅速注射的.

Kern 如何运作

Kern 是一个证书钱包,由 年龄加密。证书是加密文件,以文件夹形式排列,承诺使用。 钱包拿着 特工们用两种方法:

代理服务器 证书从不离开钱包。 代理请求 kern 发出 API 呼叫; kern 注入 auth并返回响应 .

import { openWallet, loadIdentityFromHost } from "@daslabhq/kern";

const wallet = openWallet({ identity: await loadIdentityFromHost() });

// wallet injects the Bearer token — agent never sees it
const resp = await wallet.fetch("tokens/github", "https://api.github.com/user/repos");
const repos = await resp.json();

直接 用于SDKs和非HTTP协议中需要原始证书的地方.

const key = await wallet.get("tokens/openai");
const client = new OpenAI({ apiKey: key });

两人都从同一个加密金库读取. 你选择每个证书.

快开始

# create your identity (age keypair)
kern identity init

# create the vault
mkdir -p secrets
kern identity pubkey >> secrets/.recipients

# add credentials
kern secret add tokens/github
kern secret add tokens/openai

# proxy request — credential stays in the wallet
kern fetch tokens/github https://api.github.com/user

代理整合(MCP)

添加 kern 作为 MCP 服务器 。 经纪人对钱包说话——永远不要拿着钥匙.

{
  "mcpServers": {
    "kern": {
      "command": "npx",
      "args": ["@daslabhq/kern", "mcp"]
    }
  }
}

Agent: "Fetch my GitHub repos"

→ kern_fetch(secret: "tokens/github", url: "https://api.github.com/user/repos")
→ wallet decrypts tokens/github, injects Bearer token, makes the request
→ returns JSON response to agent

Agent got the data. Never saw the token.

Agent: "Add my Stripe test key"

→ kern_add(name: "testing/stripe")
→ browser opens kern's local form
→ you paste the key
→ encrypted into secrets/testing/stripe.age

Credential went: browser → wallet → encrypted file. Agent never saw it.

MCP工具

默认布局

证书是文件夹中年龄加密的文件。 每个文件夹有一个 .recipients 文件控制谁可以解密。 将整件事情都交代给——没有私钥是密码.

secrets/
├── .recipients              # all nodes
│
├── tokens/                  # API credentials
│   ├── github.age
│   ├── openai.age
│   └── stripe.age
│
├── infra/                   # production infrastructure
│   ├── database_url.age
│   └── redis_url.age
│
└── testing/                 # dev + CI only
    ├── .recipients          # narrower: Alice + CI (not prod)
    ├── stripe_test.age
    └── llm.age

范围界定规则

• 每个文件夹可以有自己的 .recipients
• 没有 .recipients从父继承
• Prod 服务器解密 tokens/ 财务报告和审定财务报表 infra/ ——从未看到测试密钥
• CI 解密程序 testing/ - 永远不要碰亲笔证明

节点

节点是任何具有年代键盘的机器——你的笔记本电脑,CI,生产服务器.

添加队友

# Bob generates his identity
kern identity init && kern identity pubkey
# → age1xyz...

echo "age1xyz..." >> secrets/.recipients
echo "age1xyz..." >> secrets/testing/.recipients
kern secret rewrap
git commit -am "add Bob"

添加 CI 语句

kern identity init --save /tmp/ci-key
echo "$(kern identity pubkey)" >> secrets/.recipients
echo "$(kern identity pubkey)" >> secrets/testing/.recipients
kern secret rewrap
gh secret set KERN_AGE_KEY < /tmp/ci-key
rm /tmp/ci-key

中情局的一个秘密 其他一切从git解密.

取消访问

kern recipients remove age1xyz...
kern secret rewrap
kern secret rotate tokens/github  # rotate what they had access to

机器付款

保护API密钥的同一种代理保护支付证书. 一个购买计算,呼叫支付API,或者管理订阅的代理人需要支付密钥——但不应该持有.

// agent charges a customer — never sees sk_live_*
const resp = await wallet.fetch("tokens/stripe", "https://api.stripe.com/v1/payment_intents", {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: "amount=2000&currency=usd&automatic_payment_methods[enabled]=true",
});

与 条纹 MPP 机器对机器的付款 以及任何获取Bearer 认证的API. x402 (韩语) 支助——自动谈判 402 Payment Required 反应——在行进图上.

国 际

kern identity init [--save PATH]   # create age keypair
kern identity pubkey               # print public key

kern secret add [FOLDER/]NAME      # encrypt and store
kern secret get [FOLDER/]NAME      # decrypt to stdout
kern secret list                   # show all names
kern secret rotate [FOLDER/]NAME   # replace a value
kern secret delete [FOLDER/]NAME   # remove
kern secret rewrap                 # re-encrypt for current recipients

kern fetch SECRET URL [OPTIONS]    # proxy request (credential stays in wallet)
  --method POST                    # HTTP method (default GET)
  --body '{"key": "val"}'          # request body

kern recipients                    # list all recipients
kern recipients remove KEY         # remove from all folders

kern mcp                           # start MCP server
kern serve                         # start local credential form

环境

如何比较

许可证

麻省理工学院