Glossary

Components and pairing

Device: An Android app installation with its own identity and keys. It stores secrets and handles client requests. Documentation usually calls it the phone.
Client: The CLI using a particular pairing record. Commands sharing that record are the same client, even when run by different tools or agents.
Agent skill: Instructions any LLM can use to set up and use the CLI, including pairing and credential migration.
Agent plugin: Optional packaging that lets an agent host discover and install the skill. The repository provides plugin metadata and marketplaces for OpenAI and Anthropic tools.
Vault: The phone’s local store of secrets. Stored values and private keys are encrypted.
Relay: The service carrying encrypted messages between clients and phones.
Pairing: The process of connecting a client to a phone, and the authenticated relationship it creates.
Pairing address: The phone’s public, memorable address for starting a pairing. Knowing it does not grant access.
Verification code: The code you compare on the client and phone before accepting a pairing.
Client name: The label you assign on the phone. It is separate from the computer’s reported hostname.
Client ID: The identifier for a particular pairing. Pairing the same computer again creates a new client ID.

Secret: A named item selected by a client, such as github or staging-db. The name refers to the whole item, even if some contents are public.
Environment secret: A secret containing named environment variables. Selected values can be delivered through a command’s environment or standard input.
Environment variable: A name and value supplied to a process, such as GH_TOKEN and its token value.
SSH secret: A secret containing a key for SSH authentication or Git signing. The phone performs these operations without delivering the private key.
Public key: The shareable part of an SSH key, registered with servers or accounts that should accept its signatures.
Private key: The secret part used to produce signatures. Agentknock stores it encrypted on the phone.
Credential: Authentication material, such as a password, API token, or private key. A secret item may also contain non-credential information such as a database hostname.
Sensitive / non-sensitive: A value’s access classification. Sensitive values follow approval settings; non-sensitive values are available to active paired clients without approval. One environment secret can contain both.
Metadata: Descriptive information such as a secret’s name, type, description, variable names, or public SSH key. Listing metadata does not deliver sensitive values.

Request: An operation sent to the phone, such as pairing, secret use, an upload, or signing.
Secret use: The request to start a command with selected secrets. SSH authentication and Git signing are separate requests during that command.
Secret upload: A proposal from a client to create or change a stored secret. Receipt by the phone is separate from your acceptance of the change.
Reason: The explanation the client supplies for a request.
Approval mode: How a secret’s protected uses are handled: Deny, Ask, AI, or Allow. A client override replaces the default for that client and secret.
Temporary access: A four-hour grant for one client, secret, and operation type. It skips individual review within that scope; it does not change the credential’s expiry at its service.
AI review: Optional review of a request’s context against your instructions. The reviewer can approve, deny, or ask you to decide. It is separate from a coding agent using the CLI.
Instructions: Guidance you provide for AI review, globally or for a particular client or secret. Instructions do not change the selected approval mode.
Revocation: Permanently ending a client pairing. Suspension blocks access while retaining the pairing so it can be resumed.

Request history: The recent secret-use, SSH authentication, and Git signing requests shown in Requests, including automatic decisions.
Audit log: The broader history of requests and security activity, including secret edits, uploads, and client revocations.
Audit event: One entry in the audit log. Several events can describe different stages of the same request.