MintView source

Credential containment for OMP

The agent never holds the key.

Mint lets AI agents call vendor APIs without receiving the vendor credential. It injects the key inside the broker and returns a scrubbed result.

Start with MintSee the boundary
Agent requestAuthorization: Bearer __mint.vendor.default__Placeholder in. Scrubbed result out.
Agentrequest + placeholder
Mint
<credential bytes>used here only
Vendor APIcredentialed request
scrubbed result

Why we built it

The leak starts when the agent receives the credential.

In 72 hours, this agent fleet leaked API keys three times. Agents read secret files withcat and grep. The secrets entered permanent transcripts.

Smaller permissions and shorter lifetimes reduce harm. They do not make possession safe. Mint removes possession from the agent workflow.

Without Mint

The agent receives the key.

  • The key can enter memory, files, logs, prompts, or output.
  • Every tool that handles the key becomes another leak path.
  • A scanner can find a leak only after the bytes exist there.

With Mint

The agent requests an effect.

  • The agent sends a placeholder instead of a key.
  • Mint binds the request to a workload and destination.
  • The real key exists only in custody, Mint, and the vendor request.

How it works

One boundary. One job.

Mint controls where a credential can go. Another system decides whether the action itself is appropriate.

One request, three zones

See what each system can see.

01Agent
RequestPOST /proxy/https/vendor.example/v1/actionAuthorization: Bearer __mint.vendor.default__

The agent holds a harmless placeholder.

02Mint
Mint identifies the workload before it reads a credential.

Mint identifies the workload before it reads a credential.

03Vendor API
In flightAuthorization: Bearer <credential bytes>200 OK scrubbed result

The vendor receives the credential. The agent receives only the clean result.

What changes

Less credential exposure. Clearer proof.

01

Agent developers

Agents do not hold vendor keys.

Mint resolves placeholders after the request leaves the agent process.

02

Security owners

Use stays bound to its destination.

Rules bind the workload, host, method, path, and credential alias.

03

Operators and reviewers

Prepared effects leave durable evidence.

Mint records a credentialed effect before vendor contact, then attempts to record its outcome without credential values.

Proof, not promises

The gate tests the real boundary.

A local probe sends a placeholder through Mint to a test vendor. It checks the request, response, broker output, and audit log.

  1. 01
    The vendor receives the credential.

    The caller never reads it.

  2. 02
    The denied call stops before the vendor.

    Mint records the denial without resolving a key.

  3. 03
    The response and logs contain zero secret bytes.

    The zero-leak gate scans each captured surface.

  4. 04
    The audit chain must remain valid.

    Mint stops new effects when durable audit evidence is not ready.

Read the verification model

Fit

Use Mint when the agent must call an API, but must not possess its key.

Mint fits

  • OMP-driven agents call HTTP vendor APIs.
  • You can route requests through a broker.
  • You need deterministic destination and alias controls.
  • You need durable evidence for credentialed effects.

Mint does not fit

  • A tool requires a raw key in an inspectable child process.
  • You need a general vault, UI, or secret checkout API.
  • You need Mint to approve actions or manage spend.
  • You need DB, SSH, Git, or arbitrary protocol mediation today.

Direct answers

Common questions

Go deeper

Understand the boundary. Then run the proof.

The documentation starts with fit and setup. It continues through each request stage, operation, crate, and source module.

Read the documentationSee how it works