How concealer compares

Where concealer sits next to cloud password managers, DevOps secret platforms, and other local/file‑based tools — with an honest read on what it does not do.

TL;DR

concealer is a local‑only, single‑file, zero‑infra, AI‑agent native secret manager: a typed, scoped, audited front end over SOPS + age. It is not trying to be 1Password or HashiCorp Vault. It occupies a gap those tools leave open:

An encrypted, git‑friendly vault a developer (or an AI agent) can run on one machine with no server, no SaaS account, no daemon, and no cloud — but with the typing, scoping, audit trail, and agent‑safe MCP access that raw sops/age/pass don’t give you.

If you need team sharing, SSO, dynamic database credentials, or mobile autofill, concealer is the wrong tool — the tables below say so plainly.

The three markets it’s measured against

Category	Examples	What they optimize for
Cloud password managers	1Password, Bitwarden, Keeper, LastPass, Dashlane, NordPass	Human end‑users, autofill, cross‑device sync, sharing
DevOps / enterprise secret platforms	HashiCorp Vault, AWS/Azure/GCP Secret Manager, Doppler, Infisical, CyberArk Conjur	Fleets of services, dynamic secrets, rotation, RBAC, CI/CD injection
Local / file‑based OSS	SOPS+age (raw),`pass`/`gopass`, KeePassXC, git‑crypt, secretctl	Owning your data, no server, git‑versionable

concealer lives in the third market but borrows the ergonomics (typing, scoping, audit, UI) usually only found in the first two.

Master comparison matrix

Legend: ✅ yes · ⚠️ partial / with caveats · ❌ no · — n/a or unknown · ★ = only concealer

The Capability and concealer columns stay pinned while you scroll right to see every other tool; scroll down inside the table for the remaining rows. Rows marked ★ are capabilities no other tool in this table matches.

Capability	concealer	secretctl	pass / gopass	KeePassXC	1Password	Bitwarden (+ Secrets Mgr)	Keeper	LastPass	HashiCorp Vault	Doppler	Infisical	AWS Secrets Mgr	SOPS+age (raw)
Deployment	Local, single file	Local, single binary	Local	Local	SaaS	SaaS or self‑host	SaaS	SaaS	Self‑host / HCP	SaaS	SaaS or self‑host	Cloud only	Local
Requires a server / daemon	❌ none	❌ none	❌	❌	cloud	⚠️ self‑host runs a server	cloud	cloud	✅ server	✅	✅	✅	❌
Open source	✅	✅ Apache‑2.0	✅	✅	❌	✅	❌	❌	⚠️ BUSL	❌	✅	❌	✅
Cost	Free	Free	Free	Free	~$3/mo+	Free tier; SM $6–12/u/mo	~$3.75/u/mo+	~$3/mo+	Free OSS / $$$ ent.	paid tiers	Free OSS / paid cloud	usage‑based	Free
Encryption backend	age (X25519) via SOPS	AES‑256‑GCM (Argon2id)	GPG (or age)	AES / ChaCha	proprietary	proprietary	proprietary	proprietary	own / transit	managed	managed	KMS	age / PGP / KMS
Storage format	Encrypted YAML/JSON, git‑friendly	Encrypted SQLite (0600)	GPG files + git	single `.kdbx`	proprietary cloud	proprietary	proprietary	proprietary	backend store	cloud	cloud / DB	cloud	encrypted file
Git‑versionable vault	✅ values encrypted, keys visible	❌ SQLite blob	✅	⚠️ blob only	❌	❌	❌	❌	⚠️	❌	⚠️	❌	✅
Typed secrets (db/api/ssh/…)★	✅ templates	—	❌	⚠️	⚠️ item types	⚠️ item types	⚠️	⚠️	❌	❌	❌	❌	❌
Scoping	✅ first‑class (tenant/project/env/repo)	⚠️ wildcards (aws/*)	⚠️ dirs	⚠️ groups	⚠️ vaults/tags	⚠️ collections	⚠️ folders	⚠️	✅ paths/policies	✅ configs/envs	✅ envs/folders	✅ ARNs	❌
Field‑aware masking	✅ per‑field + heuristics	—	❌	✅	✅	✅	✅	✅	n/a	n/a	⚠️	n/a	❌
Web UI	✅ built‑in SPA	❌ (desktop app)	❌	❌ (desktop app)	✅	✅	✅	✅	✅	✅	✅	✅	❌
TUI / CLI	✅ both	✅ CLI	✅ CLI	⚠️	✅ CLI	✅ CLI	⚠️	⚠️	✅ CLI	✅ CLI	✅ CLI	✅ CLI	✅ CLI
Tamper‑evident audit log	✅ HMAC‑chained + head anchor	✅ HMAC‑chained	⚠️ git log	❌	⚠️ cloud logs	⚠️	✅	⚠️	✅	✅	✅	✅ CloudTrail	❌
AI‑agent / MCP native	✅ MCP server, agent gate, rate‑limit	✅ MCP, no plaintext	❌	❌	⚠️ 3rd‑party	❌	❌	❌	⚠️ SDK	⚠️ SDK	⚠️ SDK	⚠️ SDK	❌
Anti‑bulk‑exfiltration for agents★	✅ per‑agent quotas	—	❌	❌	❌	❌	❌	❌	⚠️ policy	❌	❌	⚠️ IAM	❌
Dynamic / leased secrets	❌	❌	❌	❌	❌	❌	❌	❌	✅	⚠️	✅	⚠️ rotation	❌
Automatic rotation	❌ manual	—	❌	❌	⚠️	⚠️	✅	⚠️	✅	✅	✅	✅	❌
Multi‑user / RBAC / SSO	❌ single‑owner	❌ single‑owner	⚠️ keys	❌	✅	✅	✅	✅	✅	✅	✅	✅ IAM	⚠️ recipients
Mobile app / browser autofill	❌	❌	⚠️	⚠️	✅	✅	✅	✅	❌	❌	❌	❌	❌
Works fully offline	✅	✅	✅	✅	⚠️ cache	⚠️	⚠️	⚠️	⚠️	❌	❌	❌	✅
Recovery codes / 2nd‑factor key rotation	✅ one‑time codes, code‑gated `passwd`	—	❌	⚠️ keyfile	✅ recovery kit	⚠️	✅	⚠️	⚠️ unseal keys	⚠️	⚠️	✅	❌
External dependencies	`sops`, `age`, `expect`	none (single binary)	`gpg` / `git`	Qt app	—	—	—	—	many	—	—	—	`sops`, `age`

Pricing figures are indicative 2026 list prices and change often — treat them as order‑of‑magnitude, not quotes. secretctl figures are from its public README (Apache‑2.0, Go, SQLite, AES‑256‑GCM + Argon2id, MCP). “—” marks a capability its docs don’t state.

Where concealer wins

Zero infrastructure. No server, no container, no cloud tenant, no daemon. init, and you have a vault. Vault/Doppler/Infisical all assume a running service; concealer is a script.
Git‑native. The vault is an encrypted YAML/JSON file — keys visible, values encrypted — so it diffs and versions in the same repo as your code. Raw SOPS gives you this too, but without the typing/scoping/UI/audit on top.
Agent‑first. It’s the only tool in the table with a built‑in MCP server designed around AI‑agent threat models: registered‑agent‑only gate, per‑agent bulk‑exfiltration quotas, and values that never reach the agent (run_with_secrets injects to a child env and redacts output). Everyone else bolts agents on via a generic SDK with no exfiltration ceiling.
Tamper‑evident by design. An HMAC‑chained audit log with a head anchor catches tail‑truncation — stronger than a plain file or git log, without needing a cloud audit pipeline.
No lock‑in, no telemetry, one file to read. The entire tool is one auditable Python script. Compare to trusting a proprietary cloud vault (see: the 2022 LastPass breach) or standing up Vault.

Where concealer loses (use something else)

Teams. No SSO, no RBAC, no per‑user sharing. It’s a single‑owner vault. → 1Password / Bitwarden / Vault.
Dynamic secrets & leases. No short‑lived DB creds minted on demand. → HashiCorp Vault.
Automatic rotation & CI/CD sync fabric. Manual rotation only. → Doppler / Infisical / Vault Secrets Sync.
Consumer UX. No mobile app, no browser autofill, no passkeys. → 1Password / Bitwarden / Keeper.
Compliance posture at scale. No FedRAMP/SOC2 attestations (those are organizational — earned by the entity operating a tool, not shipped by the tool; see COMPLIANCE.md). The audit log’s local ceiling — an FS‑root attacker with audit.key can re‑forge — is now mitigated by off‑machine anchor push (audit anchor → append‑only file/syslog/webhook), which audit verify checks to catch a full re‑forge. → Keeper / Vault / cloud KMS for turnkey attestations.

Closest neighbors, sharpened

vs. raw SOPS + age — same crypto and same git‑friendly file, but concealer adds typed records, scoping, masking, a web UI + TUI, an audit chain, unlock tokens, recovery codes, and the MCP server. SOPS is the engine; concealer is the car.
vs. pass / gopass — those are GPG‑over‑files with git. concealer swaps fragile GnuPG/gpg-agent for age, adds structured/typed secrets and scoping instead of one‑secret‑per‑file, and ships a UI and agent API.
vs. KeePassXC — KeePassXC is an excellent personal single‑file vault with autofill, but it’s a GUI desktop app, not git‑friendly (opaque .kdbx blob), and has no CLI‑first scoping, audit chain, or agent interface.
vs. Infisical (self‑host) — Infisical is the closest “developer secrets” competitor with an open‑source self‑host option, but it’s a full client‑server platform (DB, web service, RBAC). concealer is the answer when even that is too much to run.
vs. secretctl — the closest philosophical neighbor: also local‑first, open‑source, single‑binary, with an HMAC‑chained audit log and an MCP integration that keeps plaintext away from agents. The differences are in storage and ergonomics — secretctl stores an encrypted SQLite file (AES‑256‑GCM + Argon2id, not git‑diffable) and ships a desktop app; concealer stores a git‑friendly SOPS/age YAML vault with first‑class typed secrets, four‑dimension scoping, a built‑in web SPA + TUI, and per‑agent anti‑bulk‑exfiltration quotas. Pick secretctl for a self‑contained binary + native GUI; pick concealer for a git‑versionable, typed, scoped vault you can also drive from the browser.

Picking the right tool

If you need…	Reach for
A personal/single‑dev vault with no server, versioned in git	concealer
Safe secret access for local AI agents / MCP clients	concealer
Team sharing, SSO, mobile autofill	1Password / Bitwarden
Dynamic DB creds, leases, encryption‑as‑a‑service	HashiCorp Vault
Managed multi‑env secrets synced into CI/CD	Doppler / Infisical
Just encrypt a config file in a repo	concealer
Cloud‑native app secrets on one provider	AWS/Azure/GCP Secret Manager