DEV Community

s-gw
s-gw

Posted on

Stop giving coding agents raw credentials

#opensource #security #ai #devtools

Coding agents can run tests, call APIs, manage infrastructure, and work with local developer tools. That usefulness eventually collides with credentials.

The common options are uncomfortable: paste a token into a prompt, leave it in a broad environment variable, or let every subprocess inherit the same secret.

I built s-gw to put a local approval boundary between the agent and the credential.

Give the agent a handle, not the secret

The agent receives a typed handle that identifies the credential it needs. When it wants to act, s-gw shows the exact command, credential, environment binding, working directory, policy, and destination for local review.

s-gw overview showing local readiness, approvals, credential handles, policies, usage flow, and recent activity

The agent can request useful access without reading or retaining the raw value.

Keep execution inside one local trust loop

After approval, s-gw resolves the credential locally and injects it into one bounded child process. The command runs with the approved scope, then the output is sanitized before it returns to the agent.

s-gw trust loop from coding agent through local approval and bounded execution

The flow is:

  1. The agent sends a typed handle and an action request.
  2. The policy engine validates the request.
  3. You review and approve the command locally.
  4. The credential enters only the approved process.
  5. Sanitized output returns to the agent.
  6. The local activity log records the request, decision, and destination without recording the raw secret.

This is not meant to make a coding agent trusted. It makes credential use narrower, visible, and revocable.

See where credentials are being used

The local usage map connects agents to authentication types and destinations. It helps answer practical questions: Which agent used an AWS key? Which targets are receiving the most credentialed actions? Is an old handle still active?

s-gw credential usage map showing agent, authentication type, and target routes

Current status

s-gw is open source preview software, not a hardened enterprise secrets platform. macOS is the primary path today, Windows is preview, and Linux is experimental.

Install it from npm:

npm install -g @s-gw/s-gw
Enter fullscreen mode Exit fullscreen mode

Repository: github.com/sgateway/s-gw

Interactive demo: s-gw.com

I would especially value feedback from people using coding agents with API tokens, SSH keys, cloud credentials, local MCP tools, or 1Password. What would you need to see before letting an agent use a real credential?

Top comments (0)