stevedore

A stevedore moves cargo between vessels; stevedore moves secrets between stores. It's a Rust workspace with three crates: a library, a CLI, and an MCP server.

Stores

🟢 working · 🟡 in progress · 🔵 planned · 🔴 not planned

Store	Read	Write
Dashlane	🟢	🔴
Proton Pass	🔵	🟢

Moving secrets

Both stores' own CLIs must already be installed and logged in — stevedore never authenticates. See docs/dcli/ and docs/pass-cli/.

# what would change — writes nothing:
stevedore move --to-vault "My Vault"

# carry it out:
stevedore move --to-vault "My Vault" --apply

A move creates items; it never updates or deletes one. It passes over anything already in the vault under the same title and kind, so a move that is repeated, or resumed after an interruption, does not leave duplicates.

Two things it reports rather than decides: logins whose Dashlane note text has nowhere to go in Proton Pass, and items it found in the vault but could not read the state of. Both are listed by title so you can settle them yourself.

What it is (and isn't)

• A mover. stevedore migrates secret values from a source store to a sink store.
• Not a resolver. Runtime secret resolution — an app fetching its own key at start-up — is what secretspec does.
• Safe by default. Secret values redact themselves in logs by construction — passwords, note contents, 2FA seeds and attachment keys alike — and nothing is ever exported to disk. See Keeping secrets safe for how that guarantee is enforced.

Layout

Crate	What it is
crates/stevedore-secrets	The core library.
crates/stevedore-secrets-cli	The command-line binary.
crates/stevedore-secrets-mcp	The MCP server.

Develop

The dev environment is a Nix flake; direnv loads it on entry.

# one-time, per clone:
cp .envrc.example .envrc && direnv allow   # loads the flake dev shell
git config core.hooksPath .githooks        # arm the git hooks (pre-commit secret scan + pre-push fmt/clippy)

# or without direnv:
nix develop

# then, the usual loop:
cargo test
cargo clippy --all-targets -- -D warnings
cargo run -p stevedore-secrets-cli -- stores

CI runs fmt, clippy, test, and cargo deny check through the same flake.

A note on secrets

stevedore's inputs are your other stores' credentials. They are supplied deliberately for a single run — never committed, never loaded ambiently into every shell. The .gitignore and the .githooks/pre-commit guard exist to keep it that way.

License

Licensed under either of Apache-2.0 or MIT at your option.