Okashic is in private beta

People are giving agents real jobs now. Check my calendar, file this expense, pull the numbers off that site every morning. To do any of it, the agent needs to get into your accounts. The usual way to let it is to paste a password or an API key into a chat window.

That is the part that should stop you. Once a secret is in the chat, it is in the model’s context, in the logs, and in whatever the provider keeps. A prompt injected through a web page or an email can ask the agent to read it back. You cannot un-paste it.

Okashic takes a different path. Your passwords, keys, and personal data live in a vault that only you can open. You connect a service once, in Okashic, never in a chat. From then on your agent can use that connection, but a broker on your device is what actually applies the credential. The broker does the login or the API call, filters the answer down to what the task needs, and hands the agent only the result. The agent never sees the password.

Three parts, and where each one runs

Your vault lives on your devices. Each device holds a full, encrypted copy. Your primary password unlocks it, and the key never leaves the device. Search runs locally, so we never learn what you look for.

The broker also runs on your device. Your agent talks to it over MCP. It holds the credential for the moment it is needed, strips secrets out of every response, and writes each action to an append-only audit log that stays on your machine. You can read exactly what was accessed, by which agent, and when.

Our cloud only ever holds ciphertext. It syncs your vault between your devices and backs it up. If it were breached tomorrow, the attacker would get scrambled bytes, not your logins.

Why end to end, and not “we promise not to look”

Plenty of products store your data and promise to be careful with it. That promise is only as good as the company holding it, and it does nothing against a breach or a subpoena. End-to-end encryption means the promise is not needed. The parts that hold your vault and your keys run on your devices, and they are open source, so you can read what runs or build it yourself.

The same idea covers the agent. A poisoned page or email can make an agent ask for a connection. It cannot create one. Only you can. And when you want access gone, you revoke the agent or remove the connection, and it takes effect right away.

The beta

Okashic runs on Android and macOS today, with a headless Linux broker for agents that run on servers. It does the everyday password-manager things too: logins and autofill, one-time codes, a generator, cards and notes, import from 1Password or Bitwarden.

We are letting people in gradually while we tighten the rough edges. If you want an early spot, request an invite. We only use your email to send it.