Onyx

The problem

Agents need real credentials to do real work — a Stripe key to issue a refund, a GitHub token to open a PR, a connection string to run a query. The moment you hand one of those to a model, it lands in the context window. From there it gets logged, echoed back in a summary, written to a trace, or pulled out by a prompt injection three turns later. A secret in context is a secret in the open.

.env files and pasted keys make no distinction between two very different rights: the right to use a credential and the right to read it. An agent almost never needs the second. It needs the action the key unlocks, not the key itself — yet every standard setup grants both at once.

The threat isn't a malicious model. It's surface area: logs, traces, tool transcripts, an over-helpful summary that quotes its own environment. Each is a place a plaintext secret can come to rest. I built Onyx to take the value out of all of them.

Use-without-reveal

Onyx is a zero-knowledge vault sitting behind an MCP server. The agent calls a tool by name; the MCP server injects the actual secret into the outbound request at execution time and hands back only the result. The model works with a reference, never the value — it can use a credential it is never allowed to see.

Per-item AI tiers decide what an agent may even reach for. A secret can be open to agents, gated behind a human tap, or invisible to the model entirely — set per item, not per vault, so a read-only analytics key and a production database password never share a blast radius.

Every tool response is scrubbed on the way back. Before output reaches the model it's scanned for secret material and redacted, so a credential can't boomerang into context through a verbose API response or an error string. Underneath sits the control plane: a kill-switch that cuts all access at once, a Touch ID gate for sensitive operations, and a full audit log of every read — who, what, when, which tool.

Status

Onyx is in active development — an architecture I'm building, not a shipped product. The macOS app is Swift/SwiftUI; the agent-facing side is a Node MCP server. Today it runs WireGuard-only, on my own machines, with no users beyond me.

I'm treating it as a working answer to a question the agentic ecosystem hasn't settled: how do you give an autonomous agent the power of a credential without giving it the credential? The pieces — use-without-reveal injection, per-item tiers, output scrubbing, kill-switch, Touch ID, audit — are the shape of that answer, hardened against my own workloads before any wider claim is worth making.