inflightsec/agent-vault-proxy

agent-vault-proxy

Just-in-time API keys for AI agents - and any other process you route through it: the caller only ever sees a placeholder.

Your agent (dev laptop, CI runner, cron job, etc) gets a fake placeholder string (like sk-PLACEHOLDER-...) and uses it as if it were a real API key. This proxy sits between the caller and the internet, and swaps the fake for the real secret at the last possible moment - on the way out to the upstream API. If the caller gets prompt-injected, dumps a log, or runs a program with a software-supply-chain issue, the only thing that escapes is the fake placeholder. The real key never enters the calling process.

Under the hood: a loopback HTTPS proxy that fetches credentials from Bitwarden Secrets Manager — cloud or self-hosted — just-in-time and injects them into outbound requests, so the calling process never holds the real credential bytes in its address space.

New here? Run the Quickstart (it points you to the ~10-minute Bitwarden setup first) to see a real substitution land in the audit log, or read Concepts for the core ideas (placeholder, binding, the CA) in plain terms before you install.

How it works

On every request the proxy: checks the destination against the binding for that secret (host + optional method + optional path scope), fails closed if no binding matches (the placeholder is fo