Skip to content

Zero Secret Exposure

An AgentZ agent can call your API while it holds a placeholder in place of your API key. AgentZ swaps in the real value in the request, for hosts you list. The limits are below.

The Agent Sees a Placeholder

You create a secret on one agent. You give it a name, one or more hosts, and a value. After you save, the value is write-only, and the AgentZ API returns the secret metadata and not the value.

The agent gets an environment variable with the secret name. The value of that variable is a placeholder:

echo "$SERVICE_API_TOKEN"
# agentz:resolve:env:SERVICE_API_TOKEN

The model can put that placeholder in a request header. A per-agent proxy replaces it with the real value on the way out.

curl -H "Authorization: Bearer $SERVICE_API_TOKEN" https://api.example.com/v1/items

The Host List Decides Where a Secret Works

The proxy replaces the placeholder only when the destination host matches a host on that secret. On a mismatch, the placeholder stays a placeholder, and AgentZ does not add the real value to that request.

The swap works in HTTPS requests over HTTP/1.1. It covers headers, the URL path and the query string. It does not cover request bodies or HTTP/2.

The Sandbox Closes the Network

A sandbox lists the allowed hosts for its agents. You can write an exact domain, *.example.com for one subdomain level, or **.example.com for any depth. You can also write a CIDR range, which is an address range such as 10.0.0.0/24. The network policy of the agent denies a host that is not on the list, apart from the AgentZ services.

Model traffic goes through the AgentZ inference gateway. You do not add your model provider to the list.

Tools Are Exposed per Sandbox

Each sandbox picks which tools of an MCP connection an agent can see. An MCP connection is a link to an outside tool server. A tool you do not pick is not exposed. A picked tool is either Consent not required or Consent required.

In chat, a consent-required tool shows Deny, Always allow and Allow once. In a workflow run, no person is present, so AgentZ allows consent-required tools automatically. Expose only the tools a workflow needs.

MCP credentials follow the same rule as secrets. AgentZ stores them and adds them to the call. AgentZ does not pass them to the agent.

Build an Alert Investigation From These Parts

This example builds an alert investigation from the parts above:

  1. Add an MCP connection to your ticket tool.
  2. Create a sandbox that exposes only the ticket tools the workflow needs.
  3. Ask the agent to build the investigation workflow in chat.
  4. Create a webhook API key, and point your alert source at the workflow webhook.

Alert text comes from outside, so treat it as untrusted input.

Lens Shows What Happened

Lens shows each trace with its tool arguments and results. It also shows runtime telemetry for processes, files and network calls, with each network call marked Allowed or Blocked. The Event trail records admin changes for 30 days.

Next Step

Add a secret to an agent with Secrets.