agent-vault-proxy

Just-in-time API keys for AI agents and any other process you route through it: the caller only ever sees a placeholder.

AVP protects you from credential stealers (Shai-Hulud and similar) and prompt-injected agents leaking your secrets. It's a local proxy that injects real secrets into requests in-flight, so a compromised or prompt-injected agent has nothing to steal.

Under the hood: a loopback HTTPS proxy that fetches credentials from Bitwarden Secrets Manager — cloud or self-hosted — just-in-time and injects them into outbound requests, so the calling process never holds the real credential bytes in its address space.

Try it. 10 seconds.

1. Install — Linux pipx, macOS brew:

pipx install agent-vault-proxy
# macOS: brew install inflightsec/avp/agent-vault-proxy
sudo avp setup --bws        # paste your Bitwarden token — generates the CA, starts the daemon

2. Install the skill so your agent writes the binding for you:

/plugin marketplace add inflightsec/agent-vault-proxy
/plugin install avp@agent-vault-proxy

3. Ask the skill to broker a service — say "route the Stripe API through AVP." It mints the placeholder and prints the exact note to paste into BitWarden; it never sees your key.

4. Put the secret in your vault — add the real key to Bitwarden Secrets Manager (or Google Secret Manager) with that note, then route your agent through the proxy:

avp env && avp run claude

Done — the agent only ever sends the placeholder; AVP swaps in the real key on the wire.

Rather than avp run, you can export the proxy + CA vars in your agent's ~/.zshrc (or any shell rc) — see Usage for the canonical block. It's persistent, but it routes your whole shell through AVP, not just the agent AVP launches.

See it in action

Add a secret with your AI agent — no config editing

Onboarding a new brokered credential shouldn't mean hand-writing binding YAML. The bundled avp skill lets an AI assistant (Claude Code, or any agent that loads skills) walk you through it: you say "route the Acme API through AVP," it asks the auth shape and host, then tells you exactly what to add — the secret name plus the annotation to paste into the Bitwarden Secrets Manager Notes field (or the Google Secret Manager avp-binding annotation, or a future backend's per-secret metadata). No AVP config edit, no redeploy — and the assistant never sees or stores the secret; it proposes, you apply.

The note itself is two lines pasted into the secret's Notes field:

# avp-binding
api.acme.com

The marker line is what makes it a binding: a note whose first line isn't # avp-binding stays what it is — a human description, never parsed (ADR-0025).

Install the skill

Claude Code (recommended) — install it as a plugin, so it's available in every project and updates with /plugin marketplace update:

/plugin marketplace add inflightsec/agent-vault-proxy
/plugin install avp@agent-vault-proxy

Invoke it as /avp:avp, or just say "route the Acme API through AVP" and it triggers on its own.

Manual (any agent that loads Anthropic-format skills) — copy or symlink skills/avp/ into your agent's skills directory; Claude Code reads ~/.claude/skills/. A symlink keeps it current on git pull:

ln -s "$PWD/skills/avp" ~/.claude/skills/avp

Docs

• Is AVP for you? — what it does, what it deliberately does not do, why, and when to reach for it (start here if you're evaluating)
• Quickstart — 10-minute first run ending in a visible substitution
• Concepts — placeholder, binding, the CA, fail-closed — in plain terms
• Prerequisites — Bitwarden Secrets Manager setup (do this first)
• Linux install · Docker · macOS
• Usage — pointing your agent at the proxy
• Linux isolation — composing AVP with bubblewrap for filesystem sandboxing
• bindings.example.yaml — full config schema
• avp skill — let an AI assistant author your notes/annotation bindings (propose-only, no config edit, no redeploy)
• Architecture — threat model, G1–G9 invariants, hardening, residual risks
• Adapter architecture — vault backends (Bitwarden + Google Secret Manager ship today, static for dev) and how to add another
• Google Secret Manager — keep secrets in GSM: setup, keyless auth, and end-to-end testing
• Comparison — vs. Vault Agent, Doppler, op run, superfly/tokenizer
• CHANGELOG · SECURITY · CONTRIBUTING · CREDITS

The proxy never phones home. The only outbound connections it makes are to the BWS endpoint you configure and the upstream APIs your agent is calling. No telemetry. The audit log under /var/log/agent-vault-proxy/audit.jsonl is local-only by default; optional off-box shipping forwards it — from a separate sidecar, never the proxy — only to a collector you run and control.

License

MIT — see LICENSE. Prior art acknowledged in CREDITS.md.