SecretProxy
Keep the adapter trusted
The agent requests an operation. Your adapter validates it and adds the protected reference, using an ordinary HTTP client.
Trusted adapter → SecretProxyLet agents act.
Keep credentials
outside.
An egress proxy for AI agents. Control the services they can reach, with credentials resolved outside their runtime.
Built on our existing credential proxy. Agent-specific policies and enforced egress are in development.
A tool call should not
hand over the keys.
Agents need to call real systems. Giving them a credential also gives them something they can read, log, or copy. We’re building a request boundary where access can be controlled without placing credentials in the agent’s environment.
The foundation you
can use today.
A trusted tool adapter sends requests through SecretProxy. Source access, target bindings, and credential injection are available today. The adapter must still authorize the agent’s actions.
Resolve at the boundary
SecretProxy checks source access, matches the target binding, and decrypts the selected secret version.
Check → decrypt → injectReach the allowed API
The credential is inserted into the configured header or supported text body. The request goes to the registered host.
SecretProxy → upstream APIConnect a trusted tool adapter.
- Register your destinationAdd the upstream host and allow your adapter’s outbound IP address.
- Bind the credentialCreate a secret version and header binding. For this example, use
Authorizationwith a bearer-token template. - Use the generated referenceStore the reference in adapter configuration outside the agent’s control. Never give it to the model or an agent-controlled shell.
# Replace this demo with your binding token.
curl 'https://secretproxy.io/api.stripe.com/v1/balance' \
-H 'Authorization: {{SEC_PRXY_AES_42_demo_key_replace_me}}'// Replace this demo with your binding token.
const response = await fetch(
'https://secretproxy.io/api.stripe.com/v1/balance',
{ headers: {
Authorization: '{{SEC_PRXY_AES_42_demo_key_replace_me}}'
} }
);
const balance = await response.json();import requests
# Replace this demo with your binding token.
response = requests.get(
'https://secretproxy.io/api.stripe.com/v1/balance',
headers={'Authorization':
'{{SEC_PRXY_AES_42_demo_key_replace_me}}'},
timeout=30,
)
response.raise_for_status()Adapter-side example, not an agent prompt. Configure the target, source IP, secret, and binding first. Keep references in protected configuration; the demo token is fictional.
Rotate the credential.
Keep the rollout deliberate.
A new value creates a new secret version. Bindings stay on their chosen version until you promote them, so each integration moves when you decide.
Unversioned references follow the binding. Explicit version pins keep a caller on a chosen version.
Read about versioningBuild the boundary
around the agent.
Credential injection is the starting point. We’re developing agent-aware policies and enforced outbound access around it. These are the questions shaping that work.
Where can it connect?
Make outbound destinations explicit. The direction is an enforced egress boundary; today’s proxy bindings apply to requests that are routed through SecretProxy.
Egress designWhat may it do?
A permitted host can expose many operations. We’re exploring policies for agents and tasks. Today, action validation belongs in your trusted tool adapter.
Adapter integrationWho owns the access?
UltraNow is developing task-scoped access grants. SecretProxy is developing their outbound enforcement. Connecting the two is future work at OVRLab.
The UltraNow projectA clear boundary.
With clear responsibilities.
An agent can be untrusted while its tool adapter is trusted. Keep both the upstream credential and the sensitive reference outside the agent’s control.
Inspect the request path- Resolve the credential at the proxy
- For correctly configured calls, a trusted adapter uses a reference. SecretProxy decrypts the real credential and adds it to the outbound request. Review upstream responses before returning them to the agent.
- The reference still needs protection
- Tokens contain key material. Treat them as sensitive access material, keep them out of logs and prompts, and control which sources can use them.
- Targets and versions are explicit
- Bindings scope credential resolution to registered targets and injection policies. Unknown or malformed references are rejected before forwarding.
- Enforce the rest of the boundary
- A permitted caller can still make allowed API calls. Validate actions in the adapter, limit upstream permissions, and use sandbox or network controls to block direct egress. Changing a URL alone does not contain an agent.
Current credential
proxy plans.
Free
For a first integration and smaller workloads.
$0No monthly charge
- 2 API targets
- 5 secrets
- 10,000 proxy requests / month
- 1 team member
- Community support
Pro
For teams with more integrations to manage.
$12per target / month · billed monthly
- Unlimited secrets and requests
- Up to 20 team members
- IP allowlisting
- Secret versioning and rollback
- Priority email support
Enterprise
For teams with specific deployment requirements.
Let’s talk.Scope and pricing by arrangement
- Architecture and rollout review
- Discuss private deployment needs
- Agree on support requirements
- Plan onboarding with your team
- Review policy and access boundaries
These plans cover the existing credential proxy, not the planned agent controls. Pro is $10 per target per month when billed annually ($120 per target per year). Enterprise deployment and support requirements are agreed separately. Confirm plan availability and limits with the team before rollout.
Before you connect.
Can I use SecretProxy with an agent today?
Yes, through a trusted tool adapter that holds the reference outside the agent’s control. Source access, target bindings, injection, and rotation are available. Per-agent action policies and enforced egress are in development; your adapter and runtime must supply those controls today. Start with the adapter guide.
Does SecretProxy replace a secret manager?
It addresses how a credential reaches an outbound request. A secret manager may still be part of your storage and administration model. SecretProxy adds target bindings, version selection, and injection outside the application runtime.
Can SecretProxy see the credential?
Yes. The proxy decrypts the selected secret and uses it to construct the outbound request. SecretProxy is part of the trusted request path; this is not a zero-knowledge service.
Do I need a new SDK?
No SecretProxy SDK is required for ordinary HTTP requests. Configure source access and a binding, update the destination URL, and use the generated reference. Clients that fix the host or sign the whole request may need additional integration work.
Can we run it inside our own network?
Private and in-cluster deployment are directions to discuss with the team. Do not assume a self-service private deployment is included in the hosted plans. We can review your requirements and agree on a scope.
Built at OVRLab.
SecretProxy is part of our research into open models and infrastructure for AI agents. We publish the engineering decisions and milestones behind the work.
Explore the project