Glossary

bioProve — kovra’s word for an attended check that authorizes a sensitive action: on a Mac, in kovra’s review window (the Touch ID sensor inside it, or a code and the macOS dialog, which takes your login password, on a Mac without Touch ID). Used as a verb: “kovra asks you to bioProve it.”

Coordinate — a secret’s address, secret:<env>/<component>/<key> (e.g. secret:dev/db/password). See Coordinates.

Environment / component / key — the three segments of a coordinate: the deployment stage (dev, prod, …), the part of the system, and the specific secret.

Vault — the local, encrypted store for your secrets. Global plus one per project. See The vault.

Master key — the 256-bit key that encrypts every vault entry; custodied in the OS keyring (or derived in passphrase mode). The root of trust.

Sensitivity — how protective kovra is with a secret: low, medium, high, or inject-only. See Sensitivity tiers.

Scope — the capability boundary a session (especially an agent) operates under: which operations, projects, and environments it may address. See Agent scope.

Operation — what a caller may do with a value: read metadata, inject (deliver through a process), or reveal (return plaintext to the caller).

Reveal — bring a plaintext value back into the caller’s hands. The guarded path; never allowed for inject-only, and never to an agent for high/prod.

Injection — deliver a value through an operation into a child process’s environment; the value never returns to the caller. See The .env.refs contract.

Literal — a vault entry that holds an actual value (as opposed to a reference or a typed credential).

Reference — a vault entry that points to a value in a cloud secret manager (azure-kv://, aws-sm://), resolved at runtime under your own identity. See Cloud references.

Fingerprint — a short, truncated, keyed BLAKE3 hash of a secret’s value, shown in list to confirm “did this secret’s value change?” without revealing it. Only low/medium values outside prod have one; high, inject-only and prod values show —.

Allowlist — the set of reviewed executables a high/prod value may be injected into. Each entry pins the program’s content (an edit un-allowlists it), and generic interpreters and launchers (sh, python, node, make, …) are refused. Independent of the confirmation prompt.

Key check — keycheck.sec, a fixed value sealed under a subkey of the master key. kovra refuses to read or seal with a master key that does not open it, so a swapped Keychain key is detected.

Broker — kovra’s confirmation channel. On a Mac it is always kovra’s review window, with the Touch ID sensor inside it (the macOS dialog opens only when you click the fingerprint, or after the window shows a code when the Mac has no Touch ID); without a graphical session (e.g. over SSH) the request goes to the paired phone, in kovra’s approval app (kovra Mobile, coming soon), and with no paired phone it is refused. The cross-process kovra approve file broker exists only in development builds and on platforms kovra 0.12.1 doesn’t ship.

.env.refs — the committable file mapping env-var names to coordinates — addresses, never values.

agent.toml — the file at the vault root that scopes the governed ssh-agent.

MCP — the Model Context Protocol; how kovra exposes governed tools to AI agents. See kovra over MCP.