Ed25519 passport
sign-only private key
sk-proj-••••••••••••••••
vaultedPassControl / Agent credential gateway
Give agents cryptographic identity—not the credentials that pay for their calls. PassControl verifies each agent, enforces scope and budget, injects the vaulted provider key, and proxies the request. The key never reaches the agent.
npm install -g passcontrol
sign-only private key
sk-proj-••••••••••••••••
vaulted01 / Trust boundary
The passport only signs. A short-lived work-visa carries identity and policy into a gateway that checks every request before resolving a provider credential.
02 / Live keyless demo
This is a synthesized response, clearly marked [demo]
. The surrounding pipeline is real: challenge signing, work-visa, scope, budget, audit, and the demo tenant kill switch.
Run once, arm the switch, then run the same call again. Disarm to restore it.
Ready. The demo passport is held server-side.
03 / Control Tower
One inspectable policy boundary for agent identity, credential access, spend, revocation, and the record of every governed call.
Real OpenAI and Anthropic credentials are resolved inside the gateway only after a request passes policy. They never enter the agent runtime.
Set both limits per agent. PassControl reserves budget atomically before the provider call, when enforcement can still prevent spend.
Stop new requests at the gateway without rotating every provider key or reaching into every running agent process.
Inspect calls per agent and passport, with provider, model, status, token usage, cost, latency, and request identity in one operator view.
Keep the OpenAI or Anthropic SDK you already use. Re-point its base URL and pass a work-visa instead of a real provider credential.
Run PassControl as an MCP server for Claude Desktop, Cursor, or Claude Code—the same scope, budgets, audit, and kill switch still apply.
04 / Drop-in adoption
Keep the SDK and call shape you already use. Point the base URL at PassControl and supply the short-lived work-visa where the SDK expects an API key.
// Same SDK. Governed credential path.
const client = new OpenAI({
baseURL: "https://your-gateway/api/v1/openai",
apiKey: workVisa,
});
const response = await client.chat.completions.create({
model: "your-model",
messages,
});
passcontrol mcp
same policy boundary05 / FAQ
The short version of what PassControl is, what it protects, and what it does not — no marketing gloss.
PassControl is a source-available identity and credential gateway for AI agents. Instead of putting your OpenAI or Anthropic key inside an agent, each agent gets a cryptographic identity and a short-lived, scoped token — and the gateway injects the real key only after the request passes policy.
No. The agent holds a sign-only Ed25519 passport and mints a short-lived work-visa; the gateway resolves the real provider key from a vault and injects it in-flight, then proxies the call. The key never enters the agent runtime.
It's source-available under the Business Source License 1.1 — the full working core is free to inspect and self-host, but it is not an OSI open-source license. The plan is open-core: paid hosting and an accountability layer come later.
It's early (v0.4.x), built solo, and not yet independently audited — run it against a non-critical key first. It is built security-first (RLS on every table, a single service-role-only decrypt path, an append-only audit log, tenant-isolation tests), but test-covered and careful is not the same as audited.
OpenAI, Anthropic, Groq, Mistral, Together, and DeepSeek today. Because it is a drop-in gateway, you keep your existing SDK and just point its base URL at PassControl.
Those center on routing, caching, and observability behind a shared key. PassControl centers on per-agent cryptographic identity, capability scoping, per-agent budgets, and instant revocation — and it runs drop-in alongside them.
No — the agent does not hold the visa. A local sidecar mints and auto-refreshes it (and re-mints instantly on a 401), so a multi-hour session never times out mid-task while revocation stays near-instant. A single long streaming call is verified once at the start and finishes regardless.
Source-available / Self-host
Run the complete PassControl core on your own infrastructure and inspect every line in the credential path.
Early (v0.4.x), built in the open, not yet independently audited — run it against a non-critical key first. Security policy