Ross ROSS = Recommend OSS · open-source software intelligence for agents

pinterest/knox

Knox is a secret management service observed · 2026-08-28

github.com/pinterest/knox · Go · Apache-2.0 (permissive) observed · 2026-08-28

Health v2 · maintenance only

64/100

  • Activity 91
  • Release rhythm 8
  • Longevity 100
How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: n/a
  • age_days: 3827
  • days_rel: n/a
  • days_push: 54
  • n_releases_24m: 0

Full methodology

Adoption not part of the score

1268 stars · 117 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Knox is a self-hosted secret management service written in Go that stores, serves, and rotates secrets, keys, and credentials used by other services. It authenticates machines via mTLS and users via GitHub tokens, supports key rotation after compromise, and keeps audit logs of who accessed what.

Use cases

  • store and rotate secrets for my services
  • centralized key management with audit logging
  • securely distribute api keys and credentials to machines
  • rotate tls certificates and signing keys without a code deploy
  • self-hosted secret server with machine authentication
  • stop committing keys and passwords to git repositories

When to choose

  • You need a self-hosted central secret store with strong machine auth (mTLS) and per-user access tracking
  • Key rotation and an audit trail of secret access are requirements for your infrastructure
  • You are comfortable running a Go service (or Docker container) and building around an API/CLI workflow
  • You want to eliminate secrets scattered across git repos and laptops

When to avoid

  • You want a turnkey solution with dynamic secrets, database credential generation, or a rich web dashboard
  • A managed cloud secret manager (AWS/GCP/Azure) or HashiCorp Vault fits your stack better
  • Your project is small enough that environment variables or cloud-native options suffice
  • You cannot operate the accompanying client tooling for machine access

Facets

service · maturity active

secrets-management security security self-hosted developer-tools go self-hosted cloud key-management secret-rotation mtls audit-logging credential-storage secret-store key-rotation encryption-keys devops linux macos docker

1 source

Member repositories

RepositoryRoleHealth v2
pinterest/knoxmain64

For agents

markdown · JSON · MCP: product_card(name="pinterest/knox")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem