终端密码管理

Dependencies

• Go 1.26.3 or later
• filippo.io/age — encryption
• spf13/cobra — CLI framework
• zalando/go-keyring — OS keyring

Installation

Quick install

macOS / Linux:

curl -sSfL https://raw.githubusercontent.com/danieljustus/symaira-vault/main/scripts/install.sh | sh

Windows:

irm https://raw.githubusercontent.com/danieljustus/symaira-vault/main/scripts/install.ps1 | iex

Homebrew:

brew tap danieljustus/tap
brew install symvault

Scoop:

scoop bucket add symvault https://github.com/danieljustus/scoop-bucket
scoop install symvault

Nix (Flake): ```bash

Run directly (no install needed)

nix run github:danieljustus/symaira-vault

Quick Start

```bash

Show entry details, including the current TOTP code when configured

symvault get github

Secret execution (injects vault secrets as env vars)

symvault run --env API_KEY=api.kimi-key -- curl -H "Authorization: Bearer $API_KEY" https://api.example.com

Configuration

Global config: ~/.symvault/config.yaml. See config.yaml.example for a commented starting point.

For the full configuration reference, see docs/configuration.md.

Environment Variables

• SYMVAULT_VAULT — Path to vault directory (default: ~/.symvault)

Run specific package tests

go test ./internal/vault/... -v ```

Tests include the Go race detector by default via make test to catch concurrency issues early. Use make test-fast when iterating quickly and you want a faster feedback loop without the race detector penalty.

Some tests are skipped automatically:

• Slow tests (-short flag): Flow and binary e2e tests skip in short mode. Run without -short to execute them.
• Headless CI: Tests requiring the OS keyring (session caching) skip when no keyring backend is available (e.g., containerized or headless CI). These are environment-dependent and not failures.

Comparison

Last updated: May 2026. Features, pricing, and availability are subject to change. Please verify all details on the respective product's official website before making decisions. Disclaimer: All product names, logos, and brands referenced in this comparison are trademarks or registered trademarks of their respective owners. Use of these names is for identification and informational purposes only and does not imply endorsement, affiliation, or sponsorship. The information in this comparison is provided "as is" without warranty of any kind.

Symaira Vault differentiators:

• Terminal-native: Designed for keyboard-driven workflows without GUI dependency
• Modern encryption: age instead of GPG — simpler key management, no web of trust
• MCP-ready: Native AI agent integration via Model Context Protocol with scoped tokens and audit logging
• Zero telemetry: No analytics, no cloud dependency, no account required
• Built-in utilities: TOTP, autotype, secret execution, and password generation without external tools
• Git-native: Automatic sync with full version history of encrypted entries

Security note on AI agent chat sharing: Pasting passwords into chat interfaces exposes secrets in plaintext chat history, model training logs, and provider databases. Unlike Symaira Vault's MCP integration — which keeps credentials encrypted and uses scoped tokens with audit logging — chat sharing provides no access control, rotation, or revocation capabilities.