Agent Security Infrastructure

Credentials
never reach
the LLM.

Your agent creates a one-time link. The user fills the form. Credentials go straight to your secret store. The agent only sees { status: "ok" }.

View on GitHub

Sequence diagram · what actually happens

Agent                     ZeroCreds                      User
  │                            │                            │
  ├─POST /api/session/create──►│                            │
  │  {fields, destination}     │                            │
  │◄─{url, expires_at}─────────┤                            │
  │                            │                            │
  ├─send URL (TG / email)─────────────────────────────────►│
  │                            │                            │
  │                            │◄─GET /f/{token}───────────┤
  │                            │──form html────────────────►│
  │                            │◄─POST {credentials}────────┤
  │                            │                            │
  │                            ├─write to secret store       │
  │                            │                            │
  ├─GET /session/{t}/status────►│                            │
  │◄─{ status: "done" }──────────┤                            │
  │                            │                            │
  │  never saw credentials      │                            │

Integration Use from any agent

Your agent calls this

curl -X POST https://zerocreds.com/api/session/create \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title":       "Connect GitHub",
    "description": "Paste your token with repo scope",
    "fields": [
      {"name":"token","label":"Personal Access Token","type":"password"}
    ],
    "destination": "prod-gcp"
  }'

← { "url": "https://zerocreds.com/f/8a3f…" }

# send url to the user → wait → poll:

curl https://zerocreds.com/api/session/8a3f…/status \
  -H "Authorization: Bearer YOUR_TOKEN"

← { "status": "done" }  ✓ never saw the password

What your user sees

zerocreds.com/f/8a3f1c2d…

🔒

Connect GitHub

Paste your token with repo scope

Personal Access Token *

ghp_●●●●●●●●●●●●●●●●

Paste

👁

Credentials POST directly to ZeroCreds — never through your agent or LLM context. When the user submits, you get { status: "done" } and the values are already in your configured secret store.

Claude Code / Desktop config

# ~/.claude/settings.json

{
  "mcpServers": {
    "zerocreds": {
      "command": "npx",
      "args":    ["-y", "zerocreds-mcp"],
      "env": {
        "ZEROCREDS_TOKEN": "your-token-here"
      }
    }
  }
}

# Then Claude Code calls the tool directly:

zerocreds.collect_credentials({
  title:       "Connect GitHub",
  fields:      [{ name: "token", type: "password" }],
  destination: "local-dev"
})

← { status: "done" }  credentials in ~/agent-tokens/

How it feels in Claude Code

Coming soon · beta

Add ZeroCreds as an MCP server. Claude Code picks up the tool automatically — no manual HTTP calls, no token handling in your prompt.

Claude creates the session, waits for the user, and continues the task once { status: "done" } comes back. The credential values stay out of the conversation context entirely.

> Connect my GitHub account

Claude: collecting credentials…

🔗 Please fill: zerocreds.com/f/8a3f…

…user fills the form…

✓ Done. Continuing with GitHub access.

Storage Write-only destinations

GCP Secret Manager

Google Cloud

ZeroCreds uses roles/secretmanager.secretVersionAdder — it can push a new version but physically cannot read any secret back. Enforced by IAM, not code.

IAM: secretmanager.versions.add
NOT granted: secretmanager.versions.access
Granularity: per-secret, not project-wide

AWS Secrets Manager

Amazon Web Services

IAM policy grants only secretsmanager:PutSecretValue on a specific ARN. GetSecretValue is never in the policy — write-only by construction.

Action: secretsmanager:PutSecretValue
NOT granted: GetSecretValue
Resource: specific secret ARN

HashiCorp Vault

Self-hosted Vault

Vault policy allows create and update capabilities on the target path. read is simply omitted — Vault enforces it at the policy layer.

capabilities = ["create", "update"]
"read" not listed = denied
path: secret/data/your/path

Local File

Filesystem

Simplest option for local agents. Credentials are written as JSON to ~/agent-tokens/{uid}/{name} with mode 0600. No external dependency.

path: ~/agent-tokens/{uid}/{filename}
permissions: 0600 (owner-only read)
format: JSON object of field values

Open source.
Audit the code.
Run it yourself.

A security specialist can check the exact git commit running on your server via /version, match it to the public source code, and verify line by line what happens to user input.

Get a token in 30 seconds on zerocreds.com, or deploy on your own server for full control. MIT licensed — audit the code, fork it, run it anywhere.

MIT License

→Free for any use, commercial or personal

→Modify and distribute freely

→Self-host in 5 minutes — full control

→Contributions welcome

View source

Credentialsnever reachthe LLM.