Why trustless
AI coding agents (Claude Code, OpenCode, Codex) need API keys to call services.
Traditional setups put those keys in .env files or the agent’s environment —
which means the keys live inside the agent’s context window, where a prompt
injection or an over-verbose debug log can leak them.
trustless reverses the model: the agent references a secret by name, and the broker resolves the value at the process or transport layer. The agent never holds the plaintext.
traditional: agent → sees the key → uses the key → key in context → leak
trustless: agent → says "use GITHUB_TOKEN" → broker resolves → agent gets the API response
Four layers
trustless run
Injects credentials as env vars into a subprocess, then sanitizes stdout/stderr — raw, base64, and URL-encoded key values never surface in agent-visible output.
trustless proxy
HTTP forward proxy with per-host header/query injection (EDINET, e-Stat, xAI, OpenRouter…). MITM mode for HTTPS. No config change in the agent.
trustless serve
Integrated DLP reverse proxy for any OpenAI-compatible endpoint. Outbound LLM calls are pattern-scanned (keyword → RE2 → entropy) and masked before leaving the machine. Hot-reloads on SIGHUP.
trustless dlp scrub
Prevention fails, so erasure exists. Two-layer redaction (known values + patterns) over session DBs and logs, with FTS rebuild + VACUUM — the bytes are actually gone, not hidden.
OAuth tokens (Google, Lark) are managed with automatic refresh, and every resolution lands in an append-only structured audit log (file or journald).
How it compares
The “keep secrets away from AI agents” space has several tools. trustless is the only one combining subprocess injection + output sanitization, an integrated outbound DLP, and existing password-manager backends in a single zero-dependency binary.
| trustless | tene | vaulty | agent-secrets | |
|---|---|---|---|---|
| Injection | subprocess env + HTTP proxy | subprocess env | HTTP proxy + MCP | subprocess env (lease) |
| Existing backend (pass/Bitwarden) | ✅ | ❌ own vault | ❌ own vault | ❌ own vault |
| Output sanitization | ✅ run + proxy | ❌ | ✅ | ❌ |
| DLP (outbound redaction) | ✅ integrated | ❌ | partial (request) | ❌ |
| OAuth token management | ✅ (google/lark, refresh) | ❌ | ❌ | ❌ |
| Dependencies | 0 (single binary) | Go static | Go static | Go static |
| License | MIT | MIT | MIT | MIT |
Comparison as of August 2026.
Why you can trust it
- 321 tests with
-race— the threat model is exercised, not assumed - Zero external dependencies — a single Go binary, no runtime, no daemon required (unless you want the proxy)
- Every release is cosign-signed with an SBOM — a credential tool that can’t prove its own integrity isn’t worth installing
- MIT licensed — read it, audit it, fork it