# Carapace

**Canonical:** https://apis.io/providers/carapace-bot/  
**Website:** https://carapace.bot/  
**APIs profiled:** 1

Carapace (carapace.bot) is an open-source, Apache-2.0 secret broker for AI agents: "your agent uses the secret, never sees it." Secrets are sealed locally to a Cloud KMS key and decrypt only inside an attested AMD SEV Confidential VM running in the user's own GCP project; the enclave injects them into outbound requests only to hosts the secret's policy allows, redacts them from responses, and issues a signed receipt for every authorized use. Agents hold a Carapace API key and call through the carapace CLI. Self-hosted; the site labels it beta and not independently audited. Source is published at github.com/99darwin/carapace-oss.

## Kin Score — 17.1 / 100 (emerging)

Scored 2026-11-06 under rubric 0.27.0.

| Facet | Score |
|---|---|
| Discoverability | 66.1 |
| Contract Quality | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 36.3 |
| Developer Ergonomics | 16.7 |
| Access Clarity | 18.9 |

Regulatory layer — **Horizontal (data, software, accessibility, platform)**: 5.9 (matched via fallback).

## Agent readiness — 2.5 (human-only)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | no |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |
| Pagination Ratio | na |
| Operation Distinctiveness | na |
| MCP Tool Quality | na |

## APIs (1)

- **Carapace Server API** — Self-hosted Carapace API. Per the project docs, the control-plane server (FastAPI on Cloud Run, default URL https://<prefix>-server-<project number>.<region>.run.app) stores sea...

## Security (2)

- **Carapace Bot Authentication** — 4 schemes
- **Carapace Bot Domain Security** — TLSv1.3 · HSTS · DMARC

## Plans (1)

- **Carapace Bot Plans Pricing**

## Tags

Company, AI Agents, Secrets Management, Confidential Computing, Security, Open Source, Google Cloud, Self-Hosted

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/carapace-bot/). Scores are computed from the provider's own public artifacts under a published rubric.