Your AI agent never holds your API keys.

It sends a placeholder. The real secret is swapped in on the wire, so an agent that gets hacked or tricked has nothing to steal.

Ask your AI to set up a secret. Paste one line into your vault. Done.

Text alternative: what the 16-second demo shows

In a Claude chat, someone types: Help me give Claude access to the Stripe API. Set up the secret.
Claude answers Here's exactly what to add to your vault. I never see the key, you paste it yourself and shows a copy block, labelled paste into Bitwarden / Keychain / GSM / AWS, containing STRIPE_API_KEY and the note # kow-binding followed by api.stripe.com. The copy button confirms Copied.
macOS Keychain Access opens on an item named api.stripe.com — account STRIPE_API_KEY, service kow, kind application password — with that same two-line note pasted into the Comments field, then Save Changes.
A Keys on the Wire, Access panel lists every key an agent can reach, with each secret beside the one host it may call: STRIPE_API_KEY to api.stripe.com, ANTHROPIC_API_KEY to api.anthropic.com, GITHUB_PAT to api.github.com, OPENAI_API_KEY to api.openai.com, and SLACK_BOT_TOKEN to slack.com. Switching the vault tab from macOS Keychain to Google Secret Manager leaves the list unchanged — the config is the list, same view for any vault.

$ brew install inflightsec/keys-on-the-wire/keys-on-the-wire

$ sudo kow setup --keychain

Get started Star on GitHub

Apache-2.0 open source · runs entirely on your machine · zero telemetry, nothing ever phones home

how it works

Your agent holds a placeholder.
A fake, structurally valid key that lives in its environment exactly where the real one used to. Leak it, print it, send it to an attacker: it is worth nothing.
kow matches it against a binding.
One line in your vault says which hosts that placeholder may become a real secret for. The destination is checked against the TLS connection's real host, not the spoofable Host: header, so a redirected request gets nothing.
The real key is swapped in on the wire.
Fetched from your vault just in time and injected into the outbound request, on the connection to the upstream only. Every injection lands in an append-only audit log.

# the agent's env: a fake key, safe to leak
ANTHROPIC_API_KEY=sk-ant-PLACEHOLDER-01HXY…

$ kow run claude    # this process only

# what api.anthropic.com receives
Authorization: Bearer sk-ant-api03-…
                      ↑ the real key, swapped
                        in on the wire

Keys on the Wire in numbers

auth schemes,
signing included

vault backends,
all yours

provider presets
wired in

line to bind
a secret

telemetry,
forever

what it does

Any REST or HTTPS API

A loopback HTTPS proxy. Route any agent, app or script through it; kow injects the key into the outbound request.

Every auth scheme

Bearer, token, X-API-Key, Basic, OAuth2 refresh and client-credentials, JWT, GitHub App, HMAC and AWS SigV4.

Your vault, not ours

macOS Keychain, Bitwarden Secrets Manager, Google Secret Manager, AWS Secrets Manager, or a local file.

Service presets

Google, Microsoft, Auth0, Slack, Atlassian and Okta wired in, so common providers need no hand-tuning.

Scoped and fail-closed

Bind a key to specific methods and paths. Anything unmatched gets the placeholder forwarded verbatim, so the proxy never tells an attacker which destinations are bound. The real key is never sent.

Broker MCP servers

kow mcp install swaps a standing MCP token for a placeholder and routes that server's egress through the proxy.

why this exists

"Any time you grant an LLM-based system access to private data, exposure to untrusted content, and the ability to externally communicate you have a nasty security hole."
Simon Willison, who coined the term "prompt injection". The lethal trifecta

A single pull-request title made AI coding agents from Anthropic, Google and Microsoft read their own API keys and leak them straight back through GitHub.
Johns Hopkins researchers, "Comment and Control". The finding

where it fits

Coding agents

Claude Code, Codex, Cursor, or your own loop. kow run claude sets the proxy variables in that one process, so your login shell never inherits them and you can trial it behind a single agent first.

MCP servers

Every MCP server keeps a long-lived token in cleartext in your client config, readable by every other server the client loads. kow mcp install swaps it for a placeholder and prints the exact command to paste.

CI runners and cron

Unattended jobs that need to call an API without a key on disk or in the job environment. The runner carries a placeholder; the vault stays the only place the secret lives.

Anything you do not fully trust

A fresh npm dependency, a scraper, a script someone sent you. Shai-Hulud-style credential stealers read environments and dotfiles. There is nothing there to read.

versus the usual answer

Secret managers are good at limiting what a leaked vault token exposes. They all still end with the real key inside the process the agent controls.

Where the real secret ends up, by tool
Tool	Where the real secret ends up
Vault Agent, Infisical Agent	Rendered into a file the agent reads, and from there into its memory.
Doppler, `op run`, aws-vault	Injected into the agent's environment at start, for the whole run.
.env files and shell exports	On disk and in every child process. One injected instruction prints it.
Keys on the Wire	Never in the process at all. The agent sends a placeholder and the swap happens inside the request.

It stops theft, not misuse: kow does not judge why an API is called, so pair it with narrow scopes. The full comparison covers tokenizer, Envoy, iron-proxy and the rest, including where they win.

Take your keys off the wire.

Set up Keys on the Wire Star it on GitHub