What is AgentSecrets?
The Zero-Knowledge Difference
How AgentSecrets Works
Installation
Quick Start
Migrating from .env Files
Migrating from Vault / AWS
Migrating from dotenv-vault
Production Checklist
Credential Exposure
What Zero-Knowledge Means
The Proxy Model
The Three-Layer Model
Environments
Agent Identity
Storage Modes
The No get() Principle
Secret-Level Policies
Credential Proxy Overview
Secrets Management
Environments
env Injection
Workspaces & Teams
Projects
Agent Identity
Audit & Governance
account (init / login / logout)
server (get / set / status / reset)
secrets (set / list / delete / push / pull)
proxy (start / stop / status / logs)
call (inject requests via proxy)
env (execute commands with secrets)
workspace (list / create / switch / roles)
project (list / create / use / update)
environment (list / switch / copy / merge)
agent (register / list / tokens)
agent policy (set / get / delete)
logs (list / watch / export / verify)
mcp (serve / install / config)
status (system & session diagnostics)
Aliases & Shortcuts
docs (interactive terminal viewer)
Shell Autocompletion
keychain-auth (daemon & security)
Ecosystem Overview
Zero-Knowledge MCP Server
Integrations Overview
Claude Desktop
Cursor IDE
OpenClaw
HTTP Proxy (Any Client)
LangChain (Native)
CrewAI (Native)
CI/CD Pipeline
SDK Overview
Python SDK
Python API Reference
Python SDK Manual Testing
JavaScript SDK (Soon)
ZK-MCP Integration Guide
Server Overview
5-Layer Architecture
Self-Hosting Guide
Self-Hosting Operations Manual
Server Data Migration
Authentication & Keys
Workspaces & Teams Backend
Projects & Scope Backend
Environments Backend
Secrets & Sync Protocol
Agent Identity Resolution
Telemetry & Metrics Engine
Audit Log Sync
API Endpoint Reference
Cloud Overview & Architecture
The Dual-Engine Model
Cloud Resolver Data Plane
Workload & Agent Tokens
Egress Allowlists & Audit Streams
Cloud REST API Reference
Security Overview
Anti-Impersonation & Process Verification
Encryption Model
Zero-Knowledge Sync
Proxy Security Layers
Threat Model
OWASP Top 10 Mitigation
Security FAQ
Third-Party Audit
Reporting Vulnerabilities
Guides Overview
Building on the SDK
Stripe Integration
OpenAI Integration
Multi-Agent Setup
Onboarding Team
CI/CD Pipeline
Publishing ZK MCP
Rotating Credentials
Auditing Team Activity
Dev to Production
Kubernetes Deployment
Monorepo Setup
Production Proxy Hardening
vs .env Files
vs HashiCorp Vault
vs AWS Secrets Manager
vs dotenv-vault
vs Infisical
When Not to Use
Proxy Not Starting
Proxy Not Resolving
Domain Blocked
Sync Conflicts
MCP Not Connecting
Session Token Errors
Proxy Session Authorization
Keychain Storage & Backends
SSRF & Destination Rules
Installation Issues
Error Codes Reference
Frequently Asked Questions
v3.x
v2.1.0
v2.0.0
v1.4.0
v1.3.x
v1.2.0
v1.1.x
v1.0.x
CLI Referencelogs (list / watch / export / verify)

logs

AgentSecrets provides a comprehensive, secure, and tamper-proof auditing engine to track credential operations across your local machine and your shared workspaces.

Command Reference

agentsecrets logs list

agentsecrets logs list agentsecrets logs list --tail agentsecrets logs list --agent NAME agentsecrets logs list --identity anonymous

Lists the credential call audit logs. --tail streams live entries. --agent filters by a specific agent name. --identity anonymous finds calls with no agent identity set.

agentsecrets logs summary

agentsecrets logs summary agentsecrets logs summary --since 7d

Displays aggregated statistics of secret usage, including call counts, top keys, top active agents, and error rates.

agentsecrets logs export

agentsecrets logs export --format csv agentsecrets logs export --format json --since 30d

Exports audit log entries for external compliance review (e.g. SOC 2 or ISO 27001).

agentsecrets logs show

agentsecrets logs show <log_id>

Displays full forensic details for a specific log entry, including the domain allowlist snapshot, active capabilities, and secrets policy configuration at the millisecond of execution.

agentsecrets logs verify

agentsecrets logs verify

Verifies the cryptographic chain integrity of all forensic audit log entries stored in the local SQLite database. It recalculates the SHA-256 hash chains between sequential entries to detect any unauthorized modifications or deletions.

agentsecrets logs replay

agentsecrets logs replay <log_id>

Replays the evaluation layers of a specific request, showing exactly why a request was permitted, blocked, or redacted.


Workspace & Project Scoping

All agentsecrets logs commands are implicitly scoped to your active workspace (configured via agentsecrets workspace switch).

To filter logs for a specific project within that workspace, use the --project flag on any logs command:

agentsecrets logs list --project payments-service agentsecrets logs summary --project content-pipeline

Logging Systems Explained

AgentSecrets separates operational logging from security compliance auditing:

FeatureAudit Logs (agentsecrets logs)Proxy Daemon Logs (agentsecrets proxy logs)Allowlist Logs (workspace allowlist log)
PurposeCompliance auditing (SOC 2, ISO 27001)Live operational state & routingTracking admin changes to allowlist
Tracked InfoResolved keys, target domains, redaction, statusPort bindings, incoming connections, sync eventsAdded/removed domains, author, timestamp
Plaintext SecretsNo (Only key names and hashes)NoNo
Storage (Local)SQLite database (~/.agentsecrets/audit.db)Local temp log fileN/A
Storage (Server)Database audit_logs table (Shared workspaces)N/ADatabase WorkspaceAllowlistLog table
ImmutabilityCryptographic hash chaining (SHA-256)Standard text rotationStandard DB record logging
Was this helpful?
Thanks for your feedback!
Your feedback helps us improve the platform.