Every time I spun up an agent that needed to call GitHub, Stripe, or sign something with a PGP key, I ended up doing the same stupid thing: put the real credential somewhere the agent could read it.
Then came the inevitable “check the environment” or a log dump or a prompt injection, and the key was gone.
I wanted the opposite model: the agent should be able to use a credential without ever seeing it.
That’s what Vultrino is.
You give the agent an alias (“github-api”) and a very limited surface. Vultrino sits in the middle, holds the real secret in an encrypted vault, and does the actual authentication / signing / request. The agent only ever sees the result.
It speaks MCP natively, supports scoped API keys and single-use tokens, has human-in-the-loop approvals, and is extensible with WASM plugins. There’s also a metered LLM proxy mode so you can point any OpenAI-compatible client at it and keep the real provider key in the vault.
Tech stack is boring on purpose: Rust, Axum, rustls, AES-256-GCM + Argon2, no OpenSSL.
This is a relaunch of a much simpler/base earlier version I archived. The current one expanded far from that original.
If you’re building agents or MCP tools and have run into the same credential problem, I’d love feedback — especially on the security boundaries and the plugin ABI.
Repo: https://github.com/FeirAI/vultrino
Site: https://vultrino.com
Top comments (0)