Skip to main content
Every example below lives in the examples/ directory of the repo. Each is self-contained with its own README covering prerequisites, setup, and how to run it, and is written to be correct against the current code.

​
The boundary they all reinforce

abadge has two trust tiers, and the examples are organized around the line between them: The credential that manages the vault is never the credential that can read secrets out of it.

​
SDK — @abadge/sdk (TypeScript)

Store & grant

Operator side: store a server-managed secret, register a remote agent, grant read, read the audit trail — without ever reading the value.

Agent reads a secret

Agent side: connect with a keypair, access.read a granted secret (both storage modes), use it, disconnect.

Enroll & read

Zero-pre-shared-secret onboarding: generate a keypair locally, enroll with a one-time bootstrap token, then connect and read.
Install

​
CLI — abadge

Quickstart

Login → profile → store a secret via stdin → register an agent → grant → abadge run / mount → audit.

CI/CD injection

Non-interactive --token-stdin auth and bulk injection with abadge run --all, plus a ready GitHub Actions job.

Migrate a .env

Import a team .env with abadge import, run a build with everything injected, then delete the on-disk file.

​
MCP server — abadge-mcp

Claude Desktop / Claude Code

Wire the MCP server into an AI client so an agent can use_secret and mount_secret without the secret value ever entering the model’s context (the §RED1 boundary). Includes the config block, setup script, and the full tool walkthrough.

​
HTTP API — REST /v1 and agentic registration

Manage via curl

Management from any runtime with an abu_ key: create item, register agent, grant, read audit. Pure curl, no SDK.

Agent access in Python

Request a challenge, sign it with Ed25519, exchange for an abs_ token, and read a granted secret — no SDK.

Agentic registration

The auth.md “anonymous” flow: an agent self-registers a personal account a human later claims by email + OTP.
Point any example at your API with ABADGE_API_URL — https://api.abadge.io for the hosted service, or http://localhost:8787 for local dev. No example hardcodes a secret; everything is read from environment variables.

​
Next steps

SDK reference

Both clients, every method, and typed error handling.

CLI reference

Every command, flag, and option.

MCP overview

The five tools and the secret-redaction boundary.

API overview

REST /v1, authentication, and the error envelope.