I run AI agents for coding (OpenClaw, Claude Desktop) and realized they could read their own .env files. Tested it - asked my agent to "check configuration" and it printed everything.
The problem: agents need file access to work, but if they can read files, they can read their own credentials. One prompt injection and your API keys are leaked.
Standard solutions don't help:
- Environment variables: agent can read process.env
- Secret managers: agent needs credentials to access them
- Better prompting: can't security-patch an LLM with instructions
I built a proxy token architecture instead. The agent never sees real credentials:
- Agent has: pxr_abc123 (proxy token)
- Real keys: encrypted in OS keychain
- On API call: decrypt key, make call, scrub memory immediately
Built in 1 week. 500 npm installs with zero promotion (people are searching for this).
GitHub: https://github.com/VouchlyAI/Pincer-MCP
npm: npm install -g pincer-mcp
Works with OpenClaw, Claude Desktop, any MCP client.
Looking for security feedback - if you see holes in the architecture, please tell me. I want to know before people trust this with production credentials.
The problem: agents need file access to work, but if they can read files, they can read their own credentials. One prompt injection and your API keys are leaked.
Standard solutions don't help: - Environment variables: agent can read process.env - Secret managers: agent needs credentials to access them - Better prompting: can't security-patch an LLM with instructions
I built a proxy token architecture instead. The agent never sees real credentials:
- Agent has: pxr_abc123 (proxy token) - Real keys: encrypted in OS keychain - On API call: decrypt key, make call, scrub memory immediately
Built in 1 week. 500 npm installs with zero promotion (people are searching for this).
GitHub: https://github.com/VouchlyAI/Pincer-MCP npm: npm install -g pincer-mcp
Works with OpenClaw, Claude Desktop, any MCP client.
Looking for security feedback - if you see holes in the architecture, please tell me. I want to know before people trust this with production credentials.