Stashbase

How Stashbase works

Your agent runs in a sandbox. The proxy adds real credentials only to requests your profile allows.

Every request passes the proxy

The agent holds placeholders. The proxy decides which requests get the real value.

GET https://api.github.com/repos/acme/app/issues
Authorization: Bearer $GH_TOKENplaceholder, not the real token
Coding agentholds a placeholder
Agent Proxychecks the profile
Destinationreceives the request
  1. deny_hostsapi.github.com is not denied
  2. Destinationapi.github.com is allowed for GH_TOKEN
  3. Credential ruleGET /repos/*/*/issues* matches an allow rule

The proxy swaps the placeholder for the real token and forwards the request.

audit log action: injected

How credential rules are evaluated

The profile is the policy

One TOML file in your repository sets what the agent can reach, touch, and use.

.stashbase/agents/coding.toml
egress_hosts = ["api.anthropic.com", "registry.npmjs.org"]deny_hosts = ["api.stashbase.dev"] [filesystem]deny_read = [".env", "~/.aws"]deny_write = [".git"] [sandbox]backend = "docker" [secrets]project = "web-api"environment = "agents" [secrets.GH_TOKEN]from = "GITHUB_TOKEN" [[secrets.GH_TOKEN.rules]]effect = "allow"hosts = ["api.github.com"]methods = ["GET", "POST"]paths = ["/repos/*/*/issues*"]
Profile reference

The sandbox keeps the agent on that path

The sandbox stops the agent from going around the proxy.

Native

Default
Runs on
macOS (Seatbelt), Linux (systemd-run or bubblewrap)
Files
Deny list from the profile, enforced by the OS sandbox.
Network
Traffic goes through the Agent Proxy, with direct-network containment where supported.
Setup
Nothing beyond the CLI

Docker

Stronger isolation
Runs on
macOS, Linux, and Windows via Docker Desktop
Files
Only the working directory is visible. Denied paths inside it fail with Permission denied.
Network
A firewall allows only the Agent Proxy. DNS is disabled.
Setup
Docker. If it is not running, the run fails instead of falling back.
Inside the Docker sandbox
$ env -u HTTPS_PROXY curl https://example.com
curl: (7) Failed to connect
# skipping the proxy hits the firewall
$ nc -z host.docker.internal 5432
# blocked: host services are unreachable
$ nslookup example.com
# blocked: DNS is disabled inside the sandbox
$ iptables -F
# blocked: the agent container holds no capabilities
$ curl https://api.anthropic.com/v1/models
# allowed: in egress_hosts, sent through the proxy
Docker sandbox details

Choose where credentials are injected

Same profile, two places to inject credentials. The agent stays on your machine.

Your machine
Coding agent (placeholders only)
Agent Proxy
Credentials resolved here
Stashbase

Not in the request path. If the profile uses a Stashbase project, the local proxy fetches the values from it and holds them for the session.

  • The Agent Proxy runs on your machine for the length of the session.
  • It resolves credentials from a local file, a Stashbase project, or both.
  • Works without a Stashbase account when the profile uses only a local file.
stashbase agent run --profile coding -- claude
Compare plans

Control the tools, not just the credentials

For HTTP MCP servers, the profile decides which tools the agent sees and can call.

Profile
[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["search_issues", "get_issue"]
deny_tools = ["delete_issue"]

Server returns

  • search_issues
  • get_issue
  • create_issue
  • delete_issue

Agent sees

  • search_issues
  • get_issue
tools/call delete_issue

Rejected by the proxy, even when a client calls it directly.

Stdio MCP servers do not pass through the proxy and are not covered.

HTTP MCP servers

Desktop quickstart

Try it yourself

Open this page on macOS or Linux to install the CLI and try the local policy.

Try it on your next agent session.

Local sandboxing, the local proxy, and profiles are free. Create a workspace when you want shared credentials by project and environment.

Start for freeTry it locally
No credit card required