secr — Secrets management & NHI governance

The plugin largely matches its secrets-management purpose, but it deserves review because it handles agent secrets, fails open when its gateway cannot initialize, and may audit or log sensitive context.

Install only if you trust secr with the relevant secret and tool-audit data. Use least-privilege allowlists, keep materializeOnStartup disabled unless needed, avoid debug mode with token-based config, and decide whether the fail-open gateway behavior is acceptable for your environment.