AgentSecrets – Zero-Knowledge Credential Proxy for AI Agents

Hacker News

After seeing 8,000+ MCP servers exposed this month and the OpenClaw/ClawHavoc campaign compromise 30,000+ instances, I built a proxy that keeps credentials in the OS keychain. The agent makes authenticated API calls but never sees the key values. The core insight: AI agents are users, not applications. Applications need credential values to authenticate. Agents just need to make authenticated calls. Those are different things. AgentSecrets sits between the agent and the upstream API. The agent says "use STRIPE_KEY". The proxy resolves the real value from the OS keychain, injects it into the request at the transport layer, and returns only the response. The key never enters agent memory. Technical details: -Local HTTP proxy on localhost:8765 with session token (blocks rogue processes on same machine) -OS keychain backed — macOS Keychain, Linux Secret Service, Windows Credential Manager -6 injection styles: bearer, basic, custom header, query param, JSON body, form field -SSRF protection blocking private IPs and non-HTTPS targets -Redirect stripping — auth headers not forwarded on redirects -JSONL audit log — key names only, no value field in the struct, structurally impossible to log values -MCP server for Claude Desktop and Cursor -Native OpenClaw skill -Global storage mode config — set keychain-only once during init, applies everywhere Honest limitations: if a malicious skill has independent network access outside AgentSecrets it can still make its own calls. This removes credentials as an attack surface specifically, not every attack surface. For the specific attack that just hit 30,000 OpenClaw users — a malicious skill exfiltrating plaintext credentials — it is structurally prevented. The keys were never on the filesystem. MIT, open source.

Visit product View on Hacker NewsFeb 26, 2026

Share card

Actual performance

3points

4comments

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Product HuntOn track for Day 1 leaderboard · Strong signals: mac, agents, macos · Missing: model, apple, agentic

95%95% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Indie HackersFits the IH revenue-focused audience · Strong signals: para · Missing: supports, reddit linkedin, podcasting

60%60% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: month, users, para · Missing: mobile apps, ios, personal

40%40% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Strong signals: host, users, calls · Missing: plus, platform, intuitive

37%37% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Hacker NewsMay not resonate with HN audience · Strong signals: open source, filesystem, ide · Missing: https docs, excited, just released

32%32% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

26%26% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

0%0% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

Zero-Knowledge Proofs in WebAssembly70%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Zero-Knowledge Proofs in WebAssembly

Hacker News81

A zero-knowledge VM with only one instruction50%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

A zero-knowledge VM with only one instruction

Hacker News1

Occson – a zero-knowledge configuration store54%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Occson – a zero-knowledge configuration store

Hacker News7

Zero Knowledge Documents (on Dropbox)53%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Zero Knowledge Documents (on Dropbox)

Hacker News1

The FPGA Zero-Knowledge Playground57%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

The FPGA Zero-Knowledge Playground

Hacker News3

Orchid Mantis – A PoC in Rust for Zero Knowledge Proofs of Exploit39%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Orchid Mantis – A PoC in Rust for Zero Knowledge Proofs of Exploit

Hacker News4

Socks Proxy for AI Agents30%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Socks Proxy for AI Agents

Hacker News2

Zordle – Wordle but with zero-knowledge proofs49%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Zordle – Wordle but with zero-knowledge proofs

Hacker News25

Mysafe – Zero Knowledge ID Platform51%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Mysafe – Zero Knowledge ID Platform

Hacker News3

Zmsg – Zero knowledge messaging system built on zcash59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Zmsg – Zero knowledge messaging system built on zcash

Hacker News18

Browse all products Analyze your launch