I got tired of giving AI agents real secrets, so I built a credential proxy

dzCodes — Tue, 04 Aug 2026 12:39:35 +0000

Every time I spun up an agent that needed to call GitHub, Stripe, or sign something with a PGP key, I ended up doing the same stupid thing: put the real credential somewhere the agent could read it.

Then came the inevitable “check the environment” or a log dump or a prompt injection, and the key was gone.

I wanted the opposite model: the agent should be able to use a credential without ever seeing it.

That’s what Vultrino is.

You give the agent an alias (“github-api”) and a very limited surface. Vultrino sits in the middle, holds the real secret in an encrypted vault, and does the actual authentication / signing / request. The agent only ever sees the result.

It speaks MCP natively, supports scoped API keys and single-use tokens, has human-in-the-loop approvals, and is extensible with WASM plugins. There’s also a metered LLM proxy mode so you can point any OpenAI-compatible client at it and keep the real provider key in the vault.

Tech stack is boring on purpose: Rust, Axum, rustls, AES-256-GCM + Argon2, no OpenSSL.

This is a relaunch of a much simpler/base earlier version I archived. The current one expanded far from that original.

If you’re building agents or MCP tools and have run into the same credential problem, I’d love feedback — especially on the security boundaries and the plugin ABI.

Repo: https://github.com/FeirAI/vultrino

Site: https://vultrino.com

DEV Community: dzCodes

I got tired of giving AI agents real secrets, so I built a credential proxy