v01234567890.01234567890.01234567890github: 01234567890 starssecrets stored: 01234567890

Zero-Knowledge Credential Infrastructure:Run AI agents and production backends without exposing raw secrets at any step.

THE PROBLEM

Credentials are the backbone of the modern world. Every system runs on credentials. Databases, APIs, infrastructures. Credentials are more than just values, they are the invisible layer of authority that decides what software can access, what actions it can perform, and where its power ends.

For decades, we've built systems around controlling how humans and applications use this authority. But AI agents changed the equation.

Agents are no longer just executing predefined instructions. They reason, act, call tools, and make decisions on our behalf. And their capabilities are directly tied to the credentials they can access: an agent is only as powerful as the credentials it possesses.

The world gave AI agents autonomy, but the credential layer never evolved. AgentSecrets exists to fix that.

The missing security layer for autonomous software: controlling what agents can access, when they can access it, and how that authority is used.

Context Exposure

Every traditional secret manager hands the plaintext value to the requesting process. For an AI agent, process memory and environment variables are part of its context window. The moment a credential enters that space, it is reachable by prompt injection.

Anonymous Execution

When every agent call looks identical, there is no way to trace which agent accessed which credential, when, or why. Compromise investigations become guesswork, and shared keys cannot be revoked per-agent without breaking every workflow.

Disk-Bound Credentials

.env files and environment injection write plaintext credentials to disk or process memory, where AI agents with file-reading tools can access them on instruction. There is no boundary between the agent's capabilities and the keys it can read.

THE MODEL

Zero-knowledge runtime: the agent holds references, the infrastructure holds the keys.

Credentials are resolved inside the trusted proxy boundary and injected at the transport layer. The agent never sees the raw value.

Zero-knowledge by-reference execution

Agents never hold plaintext credentials. Every request uses a key reference resolved by the infrastructure at the transport layer, outside the agent's accessible context.

Kernel-verified transport injection

The keychain-auth daemon verifies the calling process before release. Credentials are injected at the network transport layer — never into agent memory, environment, or context.

Cryptographic agent identity

Every credential resolution is linked to a specific agent token. Full audit trail with per-agent revocation — no shared keys, no blind spots in incident response.

WORKFLOW

The agent lifecycle,
without exposure.

1Initialize
$ agentsecrets init
Initialized workspace. Keychain configured.

The agent managed the complete workflow autonomously. No credential value appeared at any step.

FEATURES

OS Keychain Storage

Credentials reside securely within the native OS keychain—macOS Keychain, Linux Secret Service, or Windows Credential Manager. Plaintext is never written to disk, and no environment variable is exposed for neighboring processes to scrape.

Zero-Knowledge Proxy

All credentialed traffic routes through a secure proxy. Keys are resolved from the keychain and injected at the transport layer, returning only the API response to the agent. Values stay out of the agent process, logs, and CLI output.

Layered Enforcement

Requests pass through a multi-stage pipeline before key resolution. Agent capabilities restrict credential access, the domain allowlist controls outbound destinations, and secrets policies define usage rules. Each enforcement layer is independent, composable, and extensible.

Secrets Policy

Define granular usage rules for individual credentials—restricting target endpoints, HTTP methods, and response behavior. Policies can block unauthorized requests or trigger interactive developer approval. This is credential-level governance built for autonomous agent workflows.

Agent Identity & Capabilities

Bind agents and workflows to unique cryptographic identities. Scope access permissions to specific projects, environments, and credentials. All execution is cryptographically attributed to a verified identity, eliminating the risks of shared wildcard API keys.

Forensic Audit Log

Capture immutable snapshots of the complete system state at the millisecond of execution. Logs record the active allowlists, agent capabilities, secrets policies, and specific pipeline decisions. Instantly verify log integrity or replay events for forensic audit.

Response Redaction

Prevent credentials from leaking through downstream outputs. If an external API echoes a secret back in its payload, the proxy dynamically redacts it before delivery. The zero-knowledge architecture protects both outbound requests and incoming responses.

Team Workspaces

Encrypt credentials client-side before cloud synchronization so the server holds only unreadable ciphertext. Onboard developers seamlessly without sharing plaintext credentials over Slack, email, or chat, keeping your configuration files completely zero-disk.

Anti-Impersonation Keychain Auth

Restrict keychain access using kernel-level process verification, validating parent PIDs, binary paths, and SHA-256 signatures. Unauthorized scripts, background malware, and rogue tooling are blocked from querying credentials even if running on the same host.

Zero trust.
Context-free credentials.

AgentSecrets provides zero-knowledge credential infrastructure for AI agents, enforcing layered governance policies and transient transport-layer injection. Your keys never enter the agent's context.

01234567890
Secrets Stored
01234567890
GitHub Stars
01234567890
Active Projects
01234567890
Requests Handled
PLATFORM — INTEGRATION

Use AgentSecrets in the
way that fits your stack

Native OpenClaw Support

AgentSecrets ships as a native exec provider for OpenClaw's SecretRef system. When your workflow references a credential, OpenClaw calls the AgentSecrets binary directly to resolve it. The value is injected at execution time and never written to any OpenClaw config file.

openclaw skill install agentsecrets
 
# Or the exec provider directly:
agentsecrets exec
 
# agentsecrets reads SecretRef from stdin,
# resolves the value, injects it.
# The calling OpenClaw skill never sees the value.
PLATFORM — BUILD ON AGENTSECRETS

Make AgentSecrets
part of your product

Use AgentSecrets as the base, then extend it to build the secure credentials infrastructure your product needs.

SDKs & TOOLS

Integrate at the runtime layer

Integrate AgentSecrets directly into your application logic using our client libraries.

Native Python SDK

Secure your agent's integrations at the runtime layer. The Python SDK transparently hooks HTTP clients to the governance proxy, preventing prompt injection leaks without changing your application code.

Modern JS/TS SDK

Integrate zero-knowledge secret injection into Node.js or Bun agent frameworks like LangChain. Credentials are resolved at the transport layer, never inside the agent context.

ECOSYSTEM

Built on AgentSecrets

Explore tools and platforms built on top of our secure credentials infrastructure.

Zero-knowledge MCP

Build and run Model Context Protocol (MCP) servers where credential values never enter the server's process memory. API keys are injected at the transport layer by the local proxy during outbound tool calls.

Enterprise Dashboard

A premium interface to manage workspaces, rotated secrets, and real-time audit logs. Complete visibility into your agent's security posture.

SUPPORT

Frequently Asked
Questions

Zero. Setup is virtually instantaneous. You can initialize the infrastructure in exactly 10 seconds with a single command: `npx @the-17/agentsecrets init`. There are no configuration files to manage, no SDK code modifications required, and no custom networking needed. It sits silently under your application process layer. You keep writing your code exactly as you do today.
AI coding assistants and local LLMs are fully capable of reading files within your workspace, including raw `.env` files containing highly sensitive production API keys. By migrating your `.env` values to AgentSecrets, your local workspace contains zero plaintext credentials. When your code runs, the values are securely fetched from your OS keychain and injected at runtime. Your coding assistant can read your entire workspace, edit your files, and execute helper tasks, but it is physically blind to your raw secrets.
Traditional secrets managers load credentials into process memory or environment variables, which can be easily extracted by an LLM via prompt injection. AgentSecrets uses a local loopback HTTP proxy. Your agent workflows or MCP servers reference keys only by their name (e.g., GITHUB_TOKEN). The local proxy intercepts outbound HTTP requests, fetches the credential from the OS keychain, injects it into the request header at the transport layer, and forwards the request. The agent process only receives the final API response—the raw key value never enters the agent's memory or context.
Standard OS keychains allow any process running under your user session to query and retrieve credentials without sandboxing. AgentSecrets integrates with a connection-bound security daemon (keychain-auth) that uses kernel-level process verification (e.g., SO_PEERCRED on Linux, LOCAL_PEERPID on macOS). It retrieves the caller's true PID, resolves its executable path, verifies its SHA-256 binary hash against a user-approved database, and enforces strict namespace permissions. Unapproved scripts or background malware are blocked from accessing your keys.
Because the AgentSecrets proxy runs entirely on the loopback interface (localhost), there is zero network transit latency. Resolving credentials from the local OS keychain and performing transport-layer injection introduces a negligible overhead of less than 2-3 milliseconds per request. This is virtually imperceptible compared to the round-trip latency of LLM APIs or upstream network requests.
Yes. Every project in AgentSecrets is pre-configured with three isolated environments: development, staging, and production. You can scope your credentials (e.g., STRIPE_KEY) specifically to any of these three environments. The local proxy automatically enforces boundaries, preventing local development runs or test agents from accidentally calling production endpoints or injecting production-level keys, keeping your test and live environments strictly separated.
When syncing secrets across a team, credentials are encrypted client-side using NaCl SealedBox (Curve25519) public-key cryptography before being sent to the sync server. The server stores only the encrypted ciphertext. Since the sync server never holds the private key or the plaintext credentials, a compromise of the sync server infrastructure yields zero readable secrets. New team members can onboard and fetch workspace configurations seamlessly without keys ever being exposed in plaintext.
AgentSecrets is designed local-first: all credential resolution, anti-impersonation process checks, and local transport-layer proxy injections occur entirely on your local machine (using loopback interfaces and your secure OS keychain). This local pipeline runs completely offline. However, the system relies on the secure API backend server for coordination tasks: user authentication, workspace synchronization, key rotation policies, and issuing verifiable cryptographic agent tokens for remote or containerized agent runtimes.
Yes. AgentSecrets is framework-agnostic. Because it injects credentials at the transport layer via a local HTTP proxy, any tool, library, or language that can route HTTP traffic through a proxy is supported. This includes LangChain, CrewAI, AutoGen, LlamaIndex, the official OpenAI and Anthropic SDKs, or even a simple curl command in bash.