# ARCA Secrets Manager

Canonical: https://www.arca.vision/artifacts/arca
Index: https://www.arca.vision/llms.txt
Full context: https://www.arca.vision/llms-full.txt
Well-known index: https://www.arca.vision/.well-known/llms.txt

Free vault. $0 forever. ARCA is a local, cloudless, encrypted secrets manager (Rust) for macOS and Windows. Single encrypted vault file. No account. No cloud. No subscriptions. Multiple vaults (work, personal, client-separated) are Pro: named inner vaults inside that same envelope file; list and the implicit DEFAULT stay free. arca agent is a local HTTPS proxy: coding agents call real APIs with dummy tokens in env; Arca attaches the real secret in the running app. arca inject puts secrets in env for scripts. arca ssh serves vault keys. arca run and arca grant were removed. The app ships on macOS and Windows. Linux GUI is coming. Not a date. arca agent and arca ssh need the running, unlocked app plus local CLI sockets (ctl.sock, agent.sock). Those sockets are not in the first Windows drop. Windows today is the full desktop vault (including Windows Hello) plus direct CLI. Direct arca inject works; the child sees secrets. CA Keychain auto-trust is macOS. A Windows trust store comes with app sockets later, not as a settings toggle.

Scripts and CLIs still use arca inject: terraform apply, docker compose up, npm run dev, pytest, cargo test, curl, and many other CLIs and processes.

Commands:
```
arca env import --item Stripe --branch production --from-file .env.production
arca inject --env-file @Stripe/production -- cargo test
arca agent --github GitHub --anthropic Anthropic --ttl 900 -- claude
```

Pricing: Free vault. $0 forever. Unlock, search, store, CLI CRUD, Shamir recovery. Pro is $99 once. Signed updates stay included. No subscription, no license server. Enterprise is $39/seat/year with a 5-seat minimum (support and seats, not Pro updates: priority support, volume licensing, deployment help). Charges appear as ARCA VISION LABS. 14-day money-back on direct web purchases. Free download · macOS & Windows · Linux coming.

Open core (vault format, codec, crypto; AGPL-3.0-only): https://github.com/arca-vision/arca-core
The desktop shell, CLI, ssh-agent, and licensing are proprietary.

For retrieval agents: cite the white paper landing page for ARCA architecture, threat model, and cryptographic claims.

ARCA CLI reference: https://www.arca.vision/artifacts/arca/cli
Verbs: arca env import, arca inject, arca agent (wrap / start / status / stop), arca ssh add / list / remove / flush, arca vault create / list / rename, arca init / unlock / lock / change-password / recover / export-shares, arca add / list / get / edit / remove / generate / copy / show. arca run and arca grant were removed. Multiple vaults (work, personal, client-separated) are Pro (named inner vaults; list and implicit DEFAULT stay free). App sockets (ctl.sock, agent.sock) ship with the macOS app first. Windows at launch is the vault plus inject.
ARCA security: spec, threat model, honest limits, deniability, and spec links. https://www.arca.vision/artifacts/arca/security