OpenSesame

An authorization fabric for the agentic era. Agents get scoped, revocable authority to act — never the secrets behind it. People keep their own credentials on their own devices. Websites get “Sign in with OpenSesame” without running a backend.

Live app · Documentation · Getting started · Architecture · Decisions · Security

Status: Pre-release / early stage. APIs and behavior may change.

---

The idea in one paragraph

An agent that needs to call GitHub, a database or a payment API normally gets handed a token, and from then on it has that token. OpenSesame inverts that. The agent holds a ConnectionRef — a handle that names a connection but contains nothing secret — and states an intent. The Host authorizes the intent against policy and grants, performs the call itself, and returns a signed receipt. There is no getSecret() anywhere in the agent-facing API, so there is nothing for a prompt injection to exfiltrate (ADR 0005).

What it does

How it fits together

flowchart LR
  subgraph Clients
    PWA["Pages PWA(static, works offline)"]
    CLI["CLIsopensesame · opensesame-id"]
    MCP["MCP / WebMCP"]
    EXT["Browser extension"]
    AG["Agents"]
  end
  subgraph Identity["Identity plane · TypeScript"]
    IDAPI["Identity API :8788OIDC issuer, principals,passkeys, claims"]
  end
  subgraph Host["Host / authority plane · Rust"]
    HOST["Host API :8787authorize → invoke → receipt"]
    D["Daemon :18790local session capabilities"]
  end
  UP[("Upstream servicesGitHub, clouds, databases")]
  PWA -. optional .-> IDAPI
  PWA -. optional .-> HOST
  CLI --> HOST
  CLI --> IDAPI
  MCP --> HOST
  EXT --> HOST
  AG -- "ConnectionRef + intent" --> HOST
  D --> HOST
  HOST -- "performs the call" --> UP

• Two APIs, deliberately separate. The Identity API answers who; the Host API answers what they may do and does it. They are never merged behind one backend (ADR 0017).
• The static app is complete on its own. The Pages PWA opens, signs in and keeps a vault with no Host, no Identity API and no server at all; each backend it can use is optional, per feature (ADR 0090).
• One client core. The PWA and the client CLI share packages/app-core and the vault-format kernel packages/vault-core; app-core’s sandbox host is proven in a bare V8 isolate, the runtime Android’s JavaScriptSandbox offers (ADR 0133).

The full picture is in docs/architecture.

Quick start

Prerequisites: Node 22+, pnpm 9 (via Corepack), and Rust 1.88 for the Host plane. Details and troubleshooting: getting started.

corepack enable
pnpm install
pnpm setup:hooks                             # lint + secret-scan hooks

# The app, no backend needed — open http://localhost:5180
pnpm --filter @opensesame/pages dev:web

# The app with a local Host, Identity API and mock IdP behind it
# (runs the Host with `cargo run --offline`: run `cargo +1.88.0 fetch` once first)
pnpm --filter @opensesame/pages dev

Or start the backends one at a time:

# Identity plane (Identity API on :8788, mock upstream IdP on :9090)
pnpm --filter @opensesame/mock-upstream-idp dev &
OPENSESAME_ALLOW_DEV_DEFAULTS=1 pnpm --filter @opensesame/control-plane start

# Host plane (Host API on :8787, daemon on :18790), one terminal each. The
# scripts generate the development secrets the binaries refuse to start without.
pnpm dev:host
pnpm dev:daemon
pnpm dev:cli -- login --flow device --no-browser

Repository layout

Everyday commands

pnpm typecheck        # every TypeScript workspace
pnpm test             # every TypeScript test suite
cargo +1.88.0 test --workspace --all-targets
pnpm lint             # Biome on files changed from origin/main
pnpm quality          # file-size, complexity and package-coupling ratchets
pnpm verify           # the full local gate: all of the above, Clippy, anti-slop, battle test

What each gate enforces and why: contributing.

AI usage disclosure

Coding agents are used under human review. See CONTRIBUTING.md.

Contributing

Read CONTRIBUTING.md, then AGENTS.md — it is the canonical rulebook for humans and coding agents alike, and its design rules gate merges. Consequential decisions get an ADR. See CODE_OF_CONDUCT.md, GOVERNANCE.md, and SECURITY.md.

Security

Report vulnerabilities privately; see SECURITY.md. The threat models, trust boundaries and the running audit log are in docs/security.

License

MIT — see LICENSE and NOTICE. What we build on instead of reinventing, and under which licenses: docs/reference/reuse.md.