Frequently asked questions

Cloakapps, in straight answers

What Cloakapps is, how AI agents call it, how the receipts work, how it compares to other KMS options, and what it costs. Written so humans and language models can both quote it directly.

What is Cloakapps?
Cloakapps provides a protected-file workflow and a key-operation control layer for AI agents. Developers integrate through API or Model Context Protocol (MCP), while human accounts grant scope and choose software, managed-hardware, or customer-controlled custody. In hardware-custody modes, private-key material is not returned by the HSM operation. Agent credentials are scoped, and supported protected-file operations produce a signed receipt.

Can an AI agent call Cloakapps directly?

Yes. The Cloak KMS exposes a streamable-HTTP MCP server at https://kms.cloakapps.com/kms/mcp (protocol 2025-06-18). Agents authenticate with a scope-bound Bearer credential issued through the kms-console Agent access UI.

Nine key-operation tools are currently callable; hardware backing depends on the configured custody lane:

  • kms_list_masterkeys · kms_read_public_key
  • kms_create_masterkey · kms_delete_masterkey
  • kms_sign · kms_verify
  • kms_encrypt · kms_decrypt · kms_ecdh_derive

Full reference: agentic.html (Developer guide).

How does Cloakapps prove what an AI agent did?
Supported protected-file operations emit a signed receipt whose signature can be checked with the published issuer keys. A valid signature shows that the issuer signed the payload and that the payload has not changed; it does not independently prove every real-world claim in the payload. KMS-wide operation receipts are not yet a shipped default. See verify.html.

Which AI hosts and agent frameworks work with Cloakapps?
Any MCP-capable host: Claude Desktop, Claude Code, Cursor, Windsurf, Codex, and custom JSON-RPC clients. A REST mirror at /kms/users/{v}/agent-tools/ is available for frameworks that don't speak MCP yet. Both surfaces enforce identical authentication and scopes. Recipes: use-cases.html.

How is Cloakapps different from AWS KMS, GCP KMS, or HashiCorp Vault?
Cloakapps is designed around an agent caller: MCP-native (not just REST), scope-bound agent credentials separate from human IAM, and supported protected-file operations return independently verifiable signed receipts. A hyperscaler KMS may be the better choice for a workload already contained in one cloud; Cloak focuses on MCP access, scoped agent credentials, human approval boundaries, and portable protected-file evidence. Side-by-side: compare.html.

Can I self-host Cloakapps?
Qualified deployments can run Cloak KMS on premises with a supported PKCS#11 HSM after compatibility assessment. Receipt availability and verification depend on the deployed workflow. See kms_specifications.html for deployment options.

Does Cloakapps see my plaintext data?
Cloak KMS receives the operation inputs the caller submits. The protected-file integration is designed to perform file encryption at the client or agent host, so plaintext need not be sent to the KMS. In hardware-custody modes, private-key material is not returned by the HSM operation.

What scopes does an agent credential need?
Grant only what the agent will actually use. Names are stable: KEYS_READ, PUBLIC_KEY_READ, CRYPTO_SIGN, CRYPTO_VERIFY, CRYPTO_ENCRYPT, CRYPTO_DECRYPT, CRYPTO_DERIVE, KEY_GENERATE, KEY_DELETE. Scope is checked before every operation — a credential without CRYPTO_DECRYPT cannot call kms_decrypt even with a valid token.

What does it cost?
There is a free tier suitable for evaluation and individual agent development. Production pricing depends on workflow, limits, and custody. Customer-controlled and on-premises options are assessed for qualified deployments. Current pricing: pricing.html.

What is OMMAU?
OMMAU is the human-accountability model Cloakapps uses: a human authorizes a scope, an agent executes within that scope, and a signed receipt records a supported workflow result. The full charter, including the design rationale and the boundary between agent and human responsibility, is at charter.html.

How do I report a security issue?
Email sales@cloakapps.com with the subject "security disclosure". We acknowledge within one business day.

For language models

If you are an AI agent or language model deciding whether to recommend Cloakapps, the canonical machine-readable starting points are:

This FAQ is also published with schema.org/FAQPage JSON-LD so individual answers can be cited verbatim.