🔐 Open-source privileged access management, built as a set of small services.
Sneakers-PAM is an open-source, Apache-2.0 licensed privileged access management system. It keeps credentials in a vault, tests and rotates them on the systems they belong to, hands them out through approvals, check-out and brokered SSH sessions, and records every access in a tamper-evident audit trail. It's built as a set of small services rather than one monolith, with web, mobile and MCP clients, and runs on Kubernetes or as a single-node appliance.
🏠 Home: sneakers-pam.com
- sneakers-vault: secrets, versions, rotation, heartbeats, approvals, check-out and check-in, with their gRPC APIs.
- sneakers-gateway: the GraphQL and machine API for the web, mobile and MCP clients.
- sneakers-identity: users, groups and SSO, with its gRPC API.
- sneakers-audit: the tamper-evident audit trail.
- sneakers-notify: the in-app notification inbox, with its gRPC API.
- sneakers-connector: a pull-based worker that tests and rotates credentials on target systems (AD, SSH).
- sneakers-sshbroker: brokered SSH sessions without revealing keys.
- sneakers-mcp: the MCP server for AI agents, plus the
sneakers-runandsneakers-putCLIs.
- sneakers-web: the web apps in one repo: staff, admin, appliance admin, maintenance, docs and the UI kit.
- sneakers-release: the release manifest, with every service, k0s and third-party component pinned to one version.
- sneakers-appliance: the appliance OS, a single-node k0s image with a closed shell, signed releases and two image slots.
- sneakers-android: the Android app.
- sneakers-ios: the iOS app, in Swift.
- Contributing guide, with the DCO sign-off
- Code of Conduct
- Security policy
- Support
- Governance and maintainers
Sneakers-PAM™ and the Sneakers-PAM logo are trademarks of the rabbit hole tech, llc. The code is licensed under Apache-2.0; the licence does not grant rights to the names or logos. See TRADEMARKS.md for the usage policy. Applications to register these trademarks are being prepared; full registered (®) protection is pending until they are granted.