spire

Programmable save editor for Slay the Spire

Policy-as-code framework for governing heterogeneous API gateway estates (Kong, AWS, Envoy). Companion code for IEEE TEMSCON Global 2026 paper. 65 tests. SLSA pipeline. SPIFFE workload identity.

Code examples for SPIFFE/SPIRE for AI Agents — production SPIRE deployments, workload identity, zero-trust authentication, and SOC2 audit patterns for autonomous AI agent infrastructure.

Zero Trust MCP server protected with SPIFFE/SPIRE, strict mTLS, and identity-based RBAC.

Home Assistant integration for Spire Gas Usage

Ansible collection to help automate the management of Spire

Reference implementation: one MCP agent shared by many tenants, where every tool call gets a 30-second PostgreSQL credential, handed over as a single-use OpenBao wrapping token and limited to one tenant by row-level security. Keycloak, SPIRE, Agentgateway, OPA, OpenBao and kagent on a local kind cluster.

Independent, provenance-grounded evaluations for AI reasoning about SPIFFE/SPIRE security, integration, and operational behavior.

Aegis: Enterprise Zero-Trust AI & MCP Security Gateway for Legacy Java/Spring Backends

An AI agent, an AI gateway, and a model upstream that all authenticate with SPIFFE SVIDs. No certificate files anywhere. Runs on docker compose.

Open standard (RFC 2119) for zero-trust, low-noise control planes in large-scale multi-agent (A2A) systems: SPIFFE/mTLS identity, regional aggregators, delta-state streaming over NATS/gRPC, Protobuf schemas, Kubernetes NetworkPolicy.

A robust and extensible Python client for interacting with the Spire Business Software API. This client provides an object-oriented interface to get, create, update, delete, query, filter, sort, and manage various Spire modules such as Sales Orders, Invoices, Inventory Items, and more.

High-Assurance Zero-Trust Microsegmentation Gateway & Ephemeral SPIFFE Workload Attestation Engine.

Zero Trust mTLS proof of concept for securing AI agent communication with SPIFFE/SPIRE.

Quantifying the “Tax of Trust”: a reproducible benchmark of SPIFFE/SPIRE vs AWS IRSA authentication latency on Kubernetes.

POC: SPIFFE JWT-SVIDs as OAuth client credentials for MCP servers, audience-bound tokens, no static keys

Comprehensive Solution Architecture: The Best of Both Worlds - Polyglot microservices with Hexagonal Architecture, SPIFFE/SPIRE zero-trust, gRPC/Protobuf, CDC, and AI/ML Intelligence Layer

Practical articles on secret exposure: business risk, architecture, implementation, response, and governance.