Agent Secrets Broker
A small service that holds secrets and makes API calls on behalf of AI agents. Agents connect to it as a remote MCP server, sign in with OAuth, and can call only the tools their policy allows. No tool ever returns a secret.
The test it is built to pass: Claude Duet asks the broker to do something that needs an API key, gets the result back, and the key never appears anywhere Duet can see.
Status: proof of concept. Two deployments:
- The sandbox holds dummy test secrets (
TEST_SECRET_A to G style values) and calls a mock upstream it hosts itself. It carries the mechanism tests, all passing against the deployed URL, and Claude Duet's own run through a claude.ai connector on 2026-11-12: six of six (docs/test-log.md).
- The live broker is for real accounts. It holds Jack's Adobe sign-in for da.live, and Claude Duet has used it end to end (2026-11-13). Its secrets are Cloudflare Worker secrets for now; 1Password is built but not in use (docs/live-setup.md).
Phase 2 results, negatives included, are in docs/findings.md.
Documentation
Two folders, for two kinds of reader:
docs/ is for people and AI agents. Start with the architecture guide: diagrams of the broker, the two sign-ins, how the localhost redirect hands the broker a one-time code that it swaps for tokens, and a tool call with approval, plus what the broker knows about who the user is.ai-docs/ is for AI agents. It holds the context an agent needs before working here: the original specs kept verbatim, session records of what was decided and what failed, and working notes.
What the broker can and can't do
Phase 2 at a glance (details and evidence in docs/findings.md):
| Experiment | Result |
|---|
| A | da.live as Jack (Adobe sign-in held by the broker) | Works. Claude Duet listed, read and saved a draft on da.live as Jack, each call approved by him. It goes through Adobe's hosted DA MCP server with a localhost sign-in, because Adobe's Developer Console offers Jack's org only server-to-server credentials |
| B | Best Buy orders with Jack's username and password | Blocked by Best Buy's terms for AI agents. No attempt made |
| C | Per-call approval for sensitive tools | Works. Shown by Claude Duet on both brokers: pending, Jack approved, ran once. Approving every call was slow for simple jobs, so on the live broker only writes need approval now |
| D | Negative tests: prompt injection, stolen tokens, revoke speed, cross-agent isolation, logs | Works with caveats. The broker contains a fooled agent but can't prevent one; a stolen refresh token works until revoke; "duet" is any Claude on Jack's account |
It can:
- Call APIs with keys agents never see. No tool returns a secret, token or credential, error messages included. A redactor scrubs every secret it has handled from anything it sends out.
- Give each agent its own tools. The owner picks the agent when approving a connection. Each agent gets only its policy's tools, and other calls are refused and audited (Duet vs AnimaMesh, tested).
- Hold a call until the owner approves it. Sensitive tools return "pending" until Jack approves that exact call on the admin page, and it then runs once. Only the owner's password session can approve, never an agent's token or the admin token. Claude Duet did this end to end on the sandbox.
- Contain a fooled agent. Text from upstreams arrives marked untrusted. A call that tries to send out a credential (its own access token, a key) is refused, and writes wait for approval. A key embedded in upstream content is redacted.
- Cut a connection off at once. Revoke takes effect on the next call and the next refresh, including tokens minted seconds earlier; that needed a fix, see findings D3.
- Rotate keys without a redeploy, and keep an audit trail. The audit log records who called what and how it went, with no arguments, contents or tokens.
- Hold a user's own sign-in for an upstream. Jack signed in on Adobe's page; the broker stores the tokens encrypted and refreshes them, and its DA tools act as him through Adobe's hosted MCP server (findings A).
It can't, or doesn't yet:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
