Sneakers-PAM v0.1.0-rc.7 is out
Privileged access,kept on a short leash™.
A vault for every privileged credential, with approvals, rotation and an audit trail nobody can quietly edit — delivered as a signed appliance you own outright.
$ sneakers-run -secret prod/db-primary -- psql
you can read this secret -- no approval needed
connecting to db-primary.example.org ...
logged: check-out by you, 08:14:02Docs
Start here.
Getting started installs the appliance and signs you in; Concepts explains how folders, approvals and rotation fit together.
What it is
One place for every privileged credential.
One place for secrets
Credentials live in folders with their own access rules, never scattered across config files or chat threads.
Approvals, not blanket access
Reveals, check-outs and break-glass access can all require a reason and, where set up, a second approver.
Rotation you can trust
A heartbeat checks that a target still matches what the vault holds, and rotation runs on a schedule or on demand.
An audit trail that can't be quietly edited
Every action is recorded in a hash-chained log; a changed, deleted or reordered record is detectable.
Built for agents too
An MCP server lets coding agents and other tools use secrets through the same approvals and audit trail as a person would.
Run it yourself
A signed, single-node appliance for VMware ESXi or Proxmox VE (amd64), or Helm charts for your own Kubernetes on amd64 or arm64. No hosted service required.
Status
Pre-1.0 notice
Sneakers-PAM is pre-1.0 and under active development. The services, the appliance and this site are all being built in the open as a from-scratch, open-source PAM. Interfaces, configuration and the install flow can still change before v0.1.0. Nothing here is ready for production use yet — most pages below mark what's still coming. Follow along or get involved on GitHub; see Contributing for how.