Arca Agent lets you grant fine-grained, scoped secret access to AI assistants like Cursor, Claude Code, and GitHub Copilot, plus local scripts and build tools, over a verified local control socket (~/.arca/ctl.sock). Each grant is session-bound and revocable. Canonical page: https://www.arca.vision/artifacts/arca/cli.

Run `arca agent start` from your project. The CLI ships with the ARCA desktop app. The agent binds a same-user, peer-verified local socket. No installer script, no cloud daemon.

How does arca inject work?

`arca inject` launches a process with environment variables resolved from the vault in memory. Templates on disk stay clean. There is no .env file to commit or scrape.

How do I revoke a grant?

Revoke with one command. Grants are session-bound: when the session ends, the assistant keeps nothing. The vault password is never part of a grant.

Does Arca Agent phone home?

No. Arca Agent reads from the encrypted vault on your machine and never phones home. No cloud APIs, no telemetry in the cryptographic core, no account system.

ARCA CLI

Your agents need secrets. Not your vault password.

Arca Agent opens a verified local socket for Cursor, Claude Code, GitHub Copilot, and your scripts. Scoped grants. Session-bound. Revocable. No .env files, no cloud APIs, no vault password in the agent.

ARCA vault

Coming September 2026

~/.arca/ctl.sock

granted: 1 secret, 1 session

Start the agent

arca agent start

COMMANDS

The CLI that talks to your vault. Not the other way around.

arca agent

Scoped grants for the tools that work for you

Start Arca Agent and grant one secret for one session. Cursor, Claude Code, and GitHub Copilot read what you allow over ~/.arca/ctl.sock. Revoke it with one command.

arca inject

Secrets in the process. Never on disk.

Run any command with vault env injected in memory. Templates stay clean. No .env file to commit, leak, or scrape.

git commit -S

SSH agent, Git signing, same vault.

Sign commits and authenticate SSH through the built-in agent socket. Keys never leave the encrypted file as plaintext.

Granted

DATABASE_URLscoped
OPENAI_API_KEYscoped

Denied

VAULT PASSWORDnever granted
.envnot on disk

FAQ

Your agents need secrets. Not your vault password.

The CLI that talks to your vault. Not the other way around.

Scoped grants for the tools that work for you

Secrets in the process. Never on disk.

SSH agent, Git signing, same vault.

How the CLI and Arca Agent work

Ready to own your secrets — and share them with your agents on your terms?

Software for missions
that matter.

The CLI that talks to your vault. Not the other way around.

Scoped grants for the tools that work for you

Secrets in the process. Never on disk.

SSH agent, Git signing, same vault.

How the CLI and Arca Agent work

Ready to own your secrets — and share them with your agents on your terms?

Software for missionsthat matter.

Software for missions
that matter.