A tool whose keys the model never sees

Loomcycle released version 1.116.0, adding a Crypto tool that lets an agent request encrypt, decrypt, rewrap, mac, verify_mac, sign, verify, public_key, totp, hash or random operations by key name while the key material stays in loomcycle sealed under LOOMCYCLE_SECRET_KEY or in Vault Transit, AWS KMS or Google Cloud KMS. The release fixes algorithms by key type (AES-256-GCM, XChaCha20-Poly1305, HMAC-SHA256/512, Ed25519, ECDSA P-256, JWE, JWS, RSA-OAEP/PSS, Argon2id and RFC 6238 TOTP) and binds tenant, source, name, version and caller context into the lcx1 envelope's AAD so a value moved to another key, scope or context does not open. The same operations ship on the operator API (POST /v1/_crypto, gRPC, MCP's crypto meta-tool, TypeScript crypto() and Python crypto()), with default-deny crypto_scopes on AgentDef, a 1 MiB per-argument limit, 100 ops per run, and every op audited without data or key material in the record.

An agent that had to protect a value or sign a request was handed the key in its prompt, where it landed in the transcript, provider logs and snapshots, or shelled out through Bash with the key in its environment. v1.116.0 ships the Crypto tool: the agent names a key, the runtime does encrypt or decrypt or rewrap or mac or verify mac or sign or verify or public key or totp or hash or random, and only the result comes back. Keys live in loomcycle sealed under LOOMCYCLE SECRET KEY, or in Vault Transit, AWS KMS or Google Cloud KMS, where the key material never leaves the KMS. Algorithms fixed by the key's type: AES-256-GCM, XChaCha20-Poly1305, HMAC-SHA256/512, Ed25519, ECDSA P-256, JWE, JWS, RSA-OAEP/PSS, Argon2id, RFC 6238 TOTP. The envelope lcx1 source name version body binds tenant, source, name, version and the caller's context to the AAD, so a value moved to another key, scope or context does not open. The same operations ship on the operator API POST /v1/ crypto, gRPC, MCP's crypto meta-tool, TS crypto , Python crypto . Default-deny grants crypto scopes on AgentDef ; 1 MiB per argument and 100 ops per run; every op audited with no data or key material in the record. Also folded in: untrusted text never reaches memory, and another user who continues a session never gets the session user's credentials.