Enforce
Secrets
Agents never receive secret material. They receive an opaque handle, and Cirvix substitutes the real value into the outbound request at the moment of use — after policy has authorized that specific destination.
The problem
A secret placed in an agent's context is in the model's context window, in the prompt log, in the trace, and in whatever the agent decides to write next. It cannot be recalled.
Capabilities
How Secrets works
- 01
Handles, not values
The agent sees `sec_handle_a89f`. That string is worthless anywhere except inside an authorized call through the broker.
- 02
Substitution at the boundary
The real value is injected into the outbound request by the proxy, bound to a destination and a scope. A handle sent anywhere else resolves to nothing.
- 03
Bring your own vault
Values stay in the vault you already run — HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager. Cirvix brokers access, it is not another place your secrets live.
- 04
Leak detection on the return path
Tool results are scanned for material matching a known secret before reaching the model, so a misbehaving endpoint that echoes a credential is caught on the way back, not after.
In practice
What it looks like
In the agent's context In your vault───────────────────────── ─────────────────────────sec_handle_a89f STRIPE_RESTRICTED_KEYsec_handle_c14d GITHUB_APP_TOKENsec_handle_7b02 POSTGRES_READONLY The left column is everything the model ever sees. It isalso everything that reaches the prompt log, the trace, andwhatever the agent decides to write next. A handle sent anywhere its policy did not sanction resolvesto nothing, and the call is denied.Limits
What this does not do
- Substitution protects the credential from the model. It does not stop an authorized call from doing something expensive — that is what policy and approvals are for.
- On a developer machine the broker holds resolved material in process memory for the life of a request. Cirvix pins those pages out of swap where the OS allows it, but a laptop with a root-level compromise is outside any userspace product's threat model, and we will not claim otherwise.
- Leak detection matches known secret material. A credential Cirvix has never been told about cannot be recognised on the return path.
Get started
Let the agents do real work.
Start with the free local scanner — it needs no account and tells you what is already ungoverned on your machine. Move to a governed runtime when you are ready.
Cirvix AgentControl is in private beta. Pricing is published and plans are not yet chargeable — early access confirms your place and we will tell you before anything bills.