Why APM?

• Fast & easy to learn — no memorizing commands or flags. APM prompts you for whatever it needs. CLI flags are also available for power users who want maximum speed.
• Zero-knowledge — your master password is never stored. Three separate 32-byte keys are derived using Argon2id. No one but you can decrypt your vault.
• Dual encryption — choose AES-256-GCM or XChaCha20-Poly1305. Double-layer integrity via HMAC-SHA256 on top of AEAD authentication.
• Portable — one vault file, one binary. Take your vault anywhere.
• Optional cloud — sync to Google Drive, GitHub, or Dropbox. Fully opt-in; no account required to use APM.
• Extensible — a manifest-based plugin system with 100+ granular permissions, lifecycle hooks, and a plugin marketplace.
• AI-ready — native MCP server with scoped tokens so Claude, Cursor, or any MCP-compatible agent can access your vault safely.
• Team-ready — full RBAC, departments, approval workflows, and shared vaults in pm-team.

Quick Start

go build -o pm .
pm setup       # initialize vault and choose security profile
pm unlock      # start a session
pm add         # add a secret (interactive)
pm get github  # fuzzy search and retrieve
pm lock        # end session

Team edition:

cd team
go build -o pm-team .

Secret Types

APM supports 25 structured secret types with validated fields and type-specific display logic:

Features

Security

• Zero-knowledge Argon2id key derivation — master password never stored
• Dual AEAD ciphers: AES-256-GCM and XChaCha20-Poly1305
• HMAC-SHA256 double-layer integrity check
• Four tunable security profiles: standard, hardened, paranoid, legacy
• Per-secret trust scoring (0–100) based on age, access, and privilege level
• Tamper-evident audit log stored outside the vault

Vault

• Single encrypted vault file — portable across any device
• Spaces for logical compartmentation (like folders)
• Fuzzy search with interactive browser and keyboard navigation
• Metadata inspector: creation date, last access, access count, trust score

TOTP

• Live countdown timers in an interactive list
• Persistent custom ordering
• Direct copy: pm totp github
• Autofill daemon integration for auto-injecting 2FA codes

Cloud Sync

• Google Drive (OAuth2 PKCE), GitHub (PAT), Dropbox (OAuth2 PKCE)
• End-to-end encrypted — providers never see plaintext
• .apmignore to filter entries per provider
• Conflict resolution: overwrite, keep local, or cancel
• Background auto-sync

Sessions

• Explicit unlock/lock with configurable expiry and inactivity timeout
• Delegated ephemeral sessions for automation and AI-agent access

MCP Server

• Native Model Context Protocol server
• Scoped permission tokens: read, secrets, write, admin
• Transaction guardrails for write ops: preview → approve → receipt
• Works with Claude Desktop, Cursor, Windsurf, and any MCP client

Plugins

• Manifest-based plugin system
• 100+ granular permissions across vault, network, system, crypto, UI, and cloud
• Hook system for vault lifecycle events
• Plugin marketplace via cloud providers

Recovery

Import / Export

Policy Engine

name: corporate-standard
password_policy:
  min_length: 14
  require_uppercase: true
  require_numbers: true
  require_symbols: true
rotation_policy:
  rotate_every_days: 90
  notify_before_days: 14

pm policy load ./policies/

Team Edition (pm-team)

• RBAC with multiple roles
• Departments with isolated encryption domains
• Approval workflows for sensitive entries
• Shared vaults for multi-user credential sharing

Security Profiles

APM auto-detects your CPU cores and RAM to recommend the optimal profile during pm setup.

Development Status and history

(This note is from the owner) As of 30th March 2026, I am currently working on the GUI for APM. At first it started as a CLI application. The issue #38 explains everything in detail. Overall, I want APM to reach an even larger demographic. I will keep the GUI separate in a apm-gui repo or create a organization and move both the repos there.

I started APM as a truly personal project. It started at a random evening, when I wanted to create my own password manager. I was sick of zoho password, since I used it for TOTPs. It was incredibly slow to ever function, and I used plaintext files for my tokens, which is not secure.

As of now, I DO NOT plan to abandon/retire the project. It will remain functional for a long time. I try to make it better everyday and use it everyday. Sometimes, the repo may be inactive, and that is when I test and experiment with the application.

Release Structure

Always back up your vault before trying Canary releases. P.S. For some releases, some tiers may not be released depending on how fast and easy they are to ship without creating more than necessary tiers.

Documentation

Full documentation at aaravmaloo.github.io/apm

• Installation
• First Steps
• CLI Reference
• Architecture
• Encryption
• Team Edition
• MCP Integration
• Contributing

Contributing

Contributions are welcome. See CONTRIBUTING.md for guidelines.

License

GPL-3.0 License © Aarav Maloo