Overview

trustless is a credential broker CLI that decouples AI agents from the secrets they use. Instead of agents holding plaintext credentials in their context window (where prompt injection or leakage can expose them), trustless acts as an intermediary: agents reference credentials by name, and the broker resolves them at the transport or process layer — the agent never holds plaintext values.

The name reflects the architecture: you don’t need to trust the agent with secrets because the agent structurally cannot access them.

Why trustless?

Traditional AI agent setups give the agent direct access to credentials — either as environment variables, config files, or inline in prompts. This means a single prompt injection or overly-verbose debug output can leak secrets to an attacker or an untrusted third-party API.

trustless inverts the model: the agent says “use GITHUB_TOKEN”, the broker resolves the value, and the agent only ever sees the API response — never the key itself.

Traditional:  agent → sees key → uses key → key is in context → prompt injection leaks it
              ↑  agent is a trusted principal

trustless:    agent → says "use GITHUB_TOKEN" → broker resolves → agent gets API response
              ↑  agent is an untrusted caller, broker is the authority

How it compares

The “keep secrets away from AI agents” space has several tools. trustless is the only one that combines subprocess injection with output sanitization, integrated DLP (outbound request redaction), and existing password-manager backends (pass / Bitwarden) in a single zero-dependency binary.

	trustless	tene	vaulty	agent-secrets	secretless-ai	enject
Injection method	subprocess env + HTTP proxy	subprocess env	HTTP proxy + MCP	subprocess env (lease)	env + shell hook	subprocess env
Existing backend (pass/Bitwarden)	✅	❌ own vault	❌ own vault	❌ own vault	❌ keychain/1Password	❌ own vault
Output sanitization	✅ run + proxy	❌	✅	❌	❌	❌
DLP (outbound redaction)	✅ integrated	❌	partial (request)	❌	❌	❌
OAuth token management	✅ (google/lark, refresh)	❌	❌	❌	❌	❌
Audit log (structured)	✅	❌	✅ file	✅ append-only	❌	❌
Agent skills bundled	✅ 4	✅ context files	MCP only	✅ skill	✅ rules	❌
Dependencies	0 (single binary)	Go static	Go static	Go static	npm/npx	Go static
License	MIT	MIT	MIT	MIT	Apache-2.0	MIT

tene / vaulty / agent-secrets / secretless-ai / enject are compared as of Aug 2026.

The practical difference: tools like tene or enject solve “agent shouldn’t read .env”. trustless also solves “agent shouldn’t see the key when it runs a command” (output sanitization) and “secrets shouldn’t leak out of the machine when the agent calls an API” (DLP). If you already use pass or Bitwarden, there is no migration — trustless reads your existing store.

← Docs