Give your agent the key
without giving it the key.
Anything an agent can read, an agent can be talked into handing over. So don't hand it a credential — hand it a placeholder, and swap in the real value at the network boundary, past anything the agent can observe.
The proxy runs on your machine or beside your workload — seekrit never sees the plaintext, because the value was encrypted on your side before it was ever stored. Read the guide →
Agents are stochastic. Credentials are not.
An agent that holds a secret will sometimes give it away — not because it was compromised, but because it decided that helping meant sharing. The industry spent 2026 learning this the expensive way.
A settings file in a cloned repository pointed ANTHROPIC_BASE_URL at attacker infrastructure, and Claude Code sent requests there before the trust prompt appeared. Patched in 2.0.65 — but the key was readable, so it was leakable.
A researcher put an instruction in a pull-request title and watched Anthropic's Claude Code Security Review action post its own API key as a comment. The same injection worked against Gemini CLI Action and Copilot Agent.
GitGuardian counted 28.6 million secrets leaked in public commits across 2025 — a 34% jump year over year, including 1.2 million AI-service keys, up 81%.
None of these are agent bugs to be patched. They are what happens when a stochastic system is handed a reusable secret — which is an argument for not handing it one.
Four things that have to be true
The agent holds a placeholder
Your workload sends {{seekrit:NAME}} — a string that names a credential without being one. It is safe in a config file, a log line, an error trace, or a transcript. Substitution happens inside the proxy, past the point the agent can read.
Default-deny, per upstream
Each route declares which secrets may be injected toward which host. A placeholder naming a secret that isn't on that list is refused with a 403 and never forwarded. Rules bound methods and paths too, so a key scoped to read can't be spent on a write.
Fail-closed at startup
The proxy resolves and decrypts everything when it boots. Bad token, unreachable API, or a layer that won't decrypt, and it refuses to start — a security control should never quietly forward an unsubstituted placeholder.
Policy we cannot forge
Egress policy is signed in your browser and verified against signers pinned in the proxy's own config. seekrit stores bytes it cannot rewrite — so the service that holds your ciphertext has no say in where your plaintext goes.
Already wired into the stack you're using
Coding agents
Claude Code, Cursor, and anything else speaking MCP. One plugin install gives the agent both servers plus the skills for using a secret without printing it.
Agent plugin →Frameworks
LangGraph, Mastra, Pydantic AI, the AI SDK, CrewAI, LlamaIndex, and both Agents SDKs — three commands to get keys in, then tighten from there.
Framework guides →Sandboxes
E2B, Modal, Daytona, Vercel Sandbox, Cloudflare Sandbox and Computer — or keep the credential outside the sandbox entirely.
Sandbox guides →A broker is only as trustworthy as the vault behind it
Keeping a credential away from your agent is worth little if the service storing it can read it anyway — you've moved the risk, not removed it. seekrit is zero-knowledge: secrets are encrypted in your browser or CLI before they leave the machine, and the server holds ciphertext and nothing else. A full database dump reveals no secret values.
The same applies to the rules. Egress policy is signed client-side and verified against signers pinned locally, so seekrit cannot rewrite where your credentials are allowed to go. You run the broker; we hold bytes we can't read and can't forge.
Start with one command
Free for one developer, no card. Point an agent at it and watch a request go out with a credential the agent never held.