Secret broker for AI agents

Use, never see: agents run commands with the value injected and never read it. Open source, Python, installed in 2 minutes.

$ tw run --env GITHUB_TOKEN=infra/github -- gh pr createtw: lead:release · grant inject:infra/* · audit #4821tw: injected GITHUB_TOKEN into pid 5122$ echo $GITHUB_TOKENtw:redacted

Audit #4821

infra/githubv3

lead:releaseattested

run · gh pr createok

deploy manifestGITHUB_TOKEN=tw://infra/githubRAILWAY_TOKEN=tw://infra/railwayLOG_LEVEL=info

Install Titanwarden

The broker at work

The agent names a secret and a command. The broker checks who is asking, writes the receipt, starts the command with the value inside it, and hands back only the output. How an agent uses it

infra

GHinfra/githubv3 · lead:releaseActive2m
RWinfra/railwayv7 · worker:ciRotating1h
DBinfra/db-passwordv2 · lead:releaseActive4m
RSmail/resend-keyv1 · worker:mailActive1d
CFinfra/cloudflare-tokenv4 · lead:releaseGrace3d
PGinfra/postgres-opsv5 · worker:backupActive6h
S3clients/evys-bucketv2 · worker:briefActive12h
OAinfra/openai-keyv1 · lead:releaseGrace5d
TGmail/telegram-botv3 · worker:briefActive1d
SGinfra/signing-keyv1 · human:jasonActive9d

acme/app agent pane release-0.2.0

~/acme/app$tw run --env TOKEN=infra/github -- gh pr create

4 of 4 checks

principal lead:releaseattestedpid 5122

grant inject:infra/*covers infra/githubv3

audit #4821committed first2ms

GITHUB_TOKEN injectedenv, at startlease 77

Pull requestgithub.com/acme/app/pull/318opened

echo $TOKENtw:redactedby the broker

Donethe agent never held the value

~/acme/app$

What the broker checks before a value moves.

Checks the calling process

Every call carries a token for one named principal, and the broker reads the calling process's ancestry before it reads anything else.

lead:release attestednowpid 5122 under pane 3, argv hash matched
CIToken issued to worker:ci4mscope inject:infra/railway, 8 hours
Grant inject:infra/* confirmed12mhuman:jason, reason: release 0.2.0

Writes the audit row

The audit row commits before the value leaves broker memory. If that write fails, the command does not start.

Delivery #4821

3 of 5

Resolve infra/github v3
Commit the audit row
Open the lease
Start the child with the value
Close the lease on exit

What never leaves the broker Keys, and the values they protect.

Seals on every restart

A restart, a crash or a deploy drops the keys. A human unseals; a freeze latches agents off; a panic seal enters lockdown.

Broker policy

4 of 5 on

Sealed on every restartKeys never on disk
Freeze latchesDeleting the file does not clear it
Audit verified on unsealA broken chain enters lockdown
Panic sealAny principal may drop the keys
Agent revealNo such operation exists

Redacts what tries to leave

Every child's output passes a redactor that knows every stored value in raw, base64, hex and percent form. A match becomes tw:redacted.

shdeploy.sh logpane-3.log 3 redacted

# the agent tries every trick
echo $RAILWAY_TOKEN
tw:redacted
echo $RAILWAY_TOKEN | base64
tw:redacted
printf %s $RAILWAY_TOKEN | xxd -p
tw:redacted
railway up # the real work still runs

Install in 2 minutes

macOS or Linux, Python 3.12 or newer, SSH from a device you trust. The first setup is human-only.

Run it yourself

git clone https://github.com/frontier-infra/titanwarden && cd titanwarden
uv sync --frozen && scripts/install.sh
twadmin init      # over SSH from your own device
twadmin unseal && tw status

Or hand it to your agent

Install Titanwarden from https://github.com/frontier-infra/titanwarden: run uv sync --frozen and scripts/install.sh, then stop. Never run twadmin init or unseal; I do those over SSH. Show me the init command when tw status says sealed.

titanwarden your machine main

~/src/titanwarden$scripts/install.sh

6 of 6 steps

~/.titanwardenhome createdmode 700

releases/8baf5c7built11s

~/bin/tw, ~/bin/twadminlinked

broker, watch, backuploadedlaunchd

tw statussealedbroker 0.1.0

nexttwadmin inityou, over SSH

Donein 1m 48s

~/src/titanwarden$

Give an agent a credential in 3 steps

Put the value in

A human types it at a hidden prompt, or the broker generates it. It never crosses a command line.

twadmin put infra/railway

2 of 4

Passphrase verified
Value read at the hidden prompt
Encrypted as version 7
Fingerprint 9c4e recorded

Grant the agent its scope

A grant names a principal, a path pattern and the operations it covers. Agents without one file a request you answer.

CIworker:ci asks for inject:infra/railwaynowreason: deploy 0.2.0, for 4 hours
Approved by human:jason1mgrant g-118, expires 00:41
tw run started under lease 782maudit #4822 committed first

Run with a manifest

A manifest holds references, not values, so it is safe to commit. The broker fills them in at start.

tw.env.tw shdeploy.sh 3 refs

# references, never values
GITHUB_TOKEN=tw://infra/github
RAILWAY_TOKEN=tw://infra/railway
DATABASE_URL=tw://infra/db-url
LOG_LEVEL=info

$ tw inject -- npm start

Questions

The ones engineers ask before they install it. The full guide

tw names infra names only

infra

infra/githubv3 · active
infra/railwayv7 · rotating
infra/db-passwordv2 · active

length bucket, last use, adapternever a value

Can an agent ever read a value?

No. The agent socket has no operation that returns plaintext. A human can, with twadmin reveal over SSH and a reason that is logged.

Are there one-time shares for clients?

Designed for the next version, not built yet: one secret per link, burned after one reveal, with a copy-and-confirm receipt.

Does it sync between machines?

Today one broker serves one machine. The design adds an opt-in cloud broker that exchanges only ciphertext, and later a tailnet transport.

Will it sync with Bitwarden or 1Password?

No two-way sync, by design. There is a one-way import from Bitwarden, run by a human from a names-only manifest.

What does it not protect against yet?

A hostile process running as the same OS user. Today's version stops accidents and records honest use; the next runs the broker as its own user.