Alpha Plugin
nexus-vault-shield
v0.1.0AlphaClassification-driven encryption for documents and project artifacts based on customer/project confidentiality levels.
Overview
Enforces encryption policies automatically based on the confidentiality level defined on customers or projects. Supports at-rest AES-256, field-level encryption with external KMS providers (AWS KMS, GCP Cloud KMS, HashiCorp Vault), and automatic watermarking on PDF exports. Every decrypt operation is logged to the audit trail.
Key Features
- Encryption policy per confidentiality level
- AWS KMS / GCP Cloud KMS / HashiCorp Vault
- Automatic watermarking on PDF exports
- Audit log for every decrypt operation
Registered Hooks
Events this plugin listens to in the OpenCode runtime.
document.uploadIntercepts document uploads and applies encryption based on the project confidentiality level before storage.
document.exportApplies watermarking and access controls to PDF exports based on classification level.
Custom Tools
MCP tools this plugin exposes to agents.
nexus_encrypt_statusReports encryption status and classification level for a given document or project.