How do I stop an AI agent from leaking my API keys?
Take the key out of the agent. Keys on the Wire is a local proxy that swaps a placeholder for the real secret in the outbound request, so the agent only ever handles a fake token. If the agent is hacked or prompt-injected, there is nothing real to steal. You add the binding once in your vault, and the agent never sees the key.
What is prompt injection, and how does it leak credentials?
Prompt injection is when an attacker hides instructions in content your agent reads: an email, a web page, a GitHub issue. The agent follows them. If the agent holds an API key in its context or environment, one injected instruction can make it print or send that key. Simon Willison calls the dangerous combination the lethal trifecta: private data, untrusted content, and a way to send data out. kow removes the credential from that mix.
Can an AI coding agent read secrets from my environment variables?
Yes, and it has happened in the wild. In the Johns Hopkins "Comment and Control" finding, a single pull-request title made coding agents from Anthropic, Google, and Microsoft read their own API keys and post them straight back through GitHub. Any agent running with a key in its environment can be talked into exposing it. kow keeps the real value out of the environment: the app emits a placeholder, and the proxy injects the secret in transit.
How do I secure API keys in an MCP server?
Each MCP server usually stores a long-lived token in cleartext in your client config, where every other server the client loads can read it. Run kow mcp install and it swaps that standing token for a placeholder, then routes the server's traffic through the proxy. The real token lives in your vault, not your config file.
Does Keys on the Wire work with any AI agent?
Yes. It is a loopback HTTPS proxy, so anything you route through it works: Claude Code, Codex, Cursor, a shell script, or your own code. Onboarding is one paste. Give any agent this line and it sets the rest up for you: "Read https://keysonthewire.com/install and set up kow for me."
Which secret vaults does it support?
macOS Keychain, Bitwarden Secrets Manager, Google Secret Manager, AWS Secrets Manager, and a local static file for trying it out. Your secrets stay in the vault you already use. kow reads them just in time and never stores a copy.
Is it safe to give an AI agent access to production keys?
Safer than handing over the raw key, with limits worth knowing. kow removes the credential from the agent, and you can scope a binding to specific HTTP methods and paths so a key only does what you allow. It stops theft, not misuse: it does not judge why an API is called, so pair it with narrow scopes. Trial it behind a single process first with kow run.
How is this different from Vault Agent, Doppler, or op run?
Those tools deliver a secret into your process, where the agent can still read it. kow never puts the real secret in the process at all. The agent sends a placeholder and the swap happens inside the request itself. The full side-by-side is in the comparison doc.
What happens if the proxy goes down?
It fails closed, and the real key is never sent either way. On a startup problem, a bad config or an unwritable audit log, the daemon refuses to serve at all, so routed calls fail rather than going out bare. On a per-request problem, an unreachable vault or a scope violation, kow forwards the placeholder unchanged and lets the upstream return its own auth failure. That quiet behaviour is deliberate: an error would tell an attacker probing your agent which destinations are bound, turning the proxy into a side channel. Set unmatched_destination_policy to deny if you would rather get a 403.
Is Keys on the Wire open source? Does it phone home?
Every feature is in the repo under Apache-2.0. The proxy collects no telemetry, and there is no paid or hosted tier. Its only outbound connections are to your vault and the APIs your agent already calls.