Cloak KMS gives developers and security engineers HSM-grade key custody via REST API and MCP tools — without buying or managing hardware. Generate keys, sign digests, rotate secrets, and audit every operation, all behind a single endpoint.
# Request { "algorithm": "ES256", "digest": "sha256:a3f9...", "key_id": "ck-prod-signing-01" } # Response — key never leaves HSM { "signature": "MEYCIQDx9n…", "key_ref": "ck-prod-signing-01", "algorithm": "ES256", "receipt": { "operation": "KEY_OPERATION", "timestamp": "2025-06-14T09:22Z", "signature": "eyJhbGci…" } }
You shouldn't need to buy and rack an HSM to get HSM-grade key protection. Cloak KMS gives you the security guarantee without the hardware burden.
Add HSM-grade key custody to your app with a single REST call. Rotate secrets on a schedule. Sign tokens and certificates without touching the private key. Every operation is audited.
Replace software key stores with hardware-backed custody. Enforce least-privilege key access policies. Get a tamper-proof audit log of every key use for SOC 2, ISO 27001, and MAS TRM compliance.
Meet regulatory key custody requirements without a CapEx HSM investment. Dedicated partitions, on-prem deployment option, and named account management for institutions that need a contractual key custody guarantee.
All operations run inside the HSM boundary. The private key never appears in memory on your server or ours.
Generate RSA-2048/4096, ECDSA P-256/P-384, AES-256 keys directly inside the HSM. Keys are assigned a stable key_id and never exported.
Pass a digest to POST /keys/{id}/sign and get a signature back. The signing operation happens inside the HSM — your plaintext or private key never leaves hardware.
Schedule automatic rotation on any key. The old key is retired after a configurable grace period. Re-encryption of dependent data is handled by the KMS — your app sees the same key_id.
Wrap your own data-encryption keys with an HSM-managed key encryption key (KEK). Store the wrapped DEK anywhere; the KEK never leaves the HSM. Standard pattern for encrypting large data at low cost.
Each account's keys are logically isolated. Dedicated HSM plans add physical partition isolation — other tenants cannot share your hardware boundary even in a system compromise scenario.
Every key operation — create, sign, rotate, expire — returns a signed audit receipt. The kms-console shows a full operation table filterable by key, time range, and calling principal.
# Agent signs a document digest via KMS result = mcp.call_tool( "kms_sign", { "alias": "agent-signing-key", "keyId": "0101", "algorithm": "ECDSA_SHA_256", "digestHex": digest_hex } ) # Signature + signed receipt returned; key never left HSM sig = result["signatureBase64"] rcpt = result["receipt"] # JWS envelope, verifiable offline # Agent provisions a new key key = mcp.call_tool( "kms_create_masterkey", { "alias": "project-alpha-signing", "keyType": "ECC_SECP256R1", "keyUsage": "SIGN" } )
AI agents that sign artifacts, encrypt outputs, or issue credentials need their own key identity — and that identity needs to be hardware-backed, auditable, and revocable. Cloak KMS gives every agent a named key in the HSM, so agent credentials are as strong as human credentials.
The MCP server exposes nine HSM-backed primitives — list, read public key, create, delete, sign, verify, encrypt, decrypt, ECDH-derive — with scoped agent credentials per tool. See the full tool reference. Every state-changing agent action embeds a signed receipt for offline audit.
kms_create_masterkey — provision an HSM key (ECC, RSA, AES)kms_sign — sign a SHA-256 digest inside the HSMkms_encrypt / kms_decrypt — bytes-level RSA-OAEP / AES-CBCStart with software keys. Upgrade to HSM when compliance or threat model demands it.
10,000 API calls/month
100,000 API calls/month
500,000 API calls/month
Pair Cloak KMS with Cloak Files and every file your team encrypts has its keys stored in hardware. Cloak Files handles file-level protection and receipts; KMS provides the HSM-backed key custody. Together: enterprise-grade file protection at SaaS pricing.
Free account. 10,000 API calls included. Full REST and MCP access from day one.
Governed by the OMMAU Charter — humans authorize, agents execute, receipts prove it.