Agentsecrets

AgentSecrets is credential infrastructure for AI agents and engineering teams that lets software call APIs by reference instead of holding raw keys. Secrets live in the native OS keychain (macOS Keychain, Linux Secret Service or Windows Credential Manager), and a local proxy resolves each reference and injects the value at the network transport layer, so the credential never enters the agent's memory, environment, logs or context window where prompt injection could reach it. It is aimed at developers running autonomous agents and production backends who no longer want plaintext keys in .env files. A command line workflow covers initializing a workspace, storing secrets, registering agents with their own cryptographic tokens, scoping each agent to specific credentials, restricting a key to allowed domains, starting the proxy and making calls through it. Layered enforcement combines agent capabilities, a domain allowlist and per secret policies that can limit endpoints and HTTP methods or require interactive approval. Other features include response redaction when an API echoes a secret back, a forensic audit log attributed to each agent, kernel level process verification before keychain release, and team workspaces that encrypt credentials client side before cloud sync. Python and JavaScript or TypeScript SDKs hook existing HTTP clients, it ships as a native exec provider for OpenClaw, and it supports zero knowledge MCP servers. The core project is open source under the MIT license. No pricing page is published; the site mentions a premium Enterprise Dashboard for managing workspaces, rotated secrets and audit logs, but gives no plans or amounts for it.