An experimental, self-hosted credential proxy for cooperative AI agents. Placeholder injection reduces accidental key exposure in prompts and configuration, but the current build is not a security boundary for an untrusted process running as the same OS user.
Built natively into REX, ClassEve’s desktop AI, as a routed-credential policy layer. Do not rely on this release to contain a malicious or fully compromised same-user agent.
Windows-first, Node / TypeScript, Apache-2.0. Open source — clone it or browse the repo:
A client configured to use Airlock receives dummy values like __OPENAI_KEY__instead of a real credential. This reduces accidental inclusion in prompts, configuration, and ordinary logs; it does not stop a same-user process from attacking Airlock’s files or admin channel.
Requests routed through the loopback proxy are checked before credential injection and logged. The proxy is not an operating-system sandbox: an untrusted child needs a separate restricted identity, file ACLs, and OS-enforced egress controls before this becomes a hard boundary.
DPAPI on Windows protects the vault against offline disk theft and other OS accounts. It does not protect the vault from code already running as the same Windows user.
This wins on execution and honesty, not on novel cryptography. It is not “unbreakable” — nobody’s is, and we do not claim it. The architecture is not new: dummy keys plus an injecting proxy already ship as open-source and commercial products.
It reduces accidental key exposure for cooperative clients. It does not make a hijacked agent safe, and the current same-user launcher cannot prevent a malicious child from reading Airlock data or its admin token. Policy and approval do not repair that missing OS boundary.
Airlock configures cooperative HTTP(S) clients to use its proxy; it is not an operating-system network sandbox. A child process that deliberately opens a direct socket can bypass that proxy unless you add an OS-enforced egress boundary.
Fully self-hosted: ClassEve does not receive your keys. Sealing is on by default through the OS-native root of trust, with a documented hardware-TPM upgrade path. That protects data at rest; process isolation is a separate requirement.
Status today: research preview, not a production security boundary and not third-party audited. It becomes a hard isolation boundary only once the broker and untrusted agent run under distinct restricted OS identities, vault/admin access is ACL-isolated, direct network bypass is contained, and DNS resolutions are pinned to the connections they authorize.
Credential Airlock is an experimental, self-hosted credential proxy for cooperative AI agents. It uses placeholder injection and an OS-sealed vault to reduce accidental exposure, but the current release is not an isolation boundary for an untrusted process running as the same OS user.
It does not guarantee that against a malicious same-user agent. For a cooperative client, the real value stays out of ordinary prompts and configuration because the proxy injects it later. A hard guarantee requires separate restricted OS identities, ACL-isolated vault/admin access, and enforced egress controls; those are not complete in this release.
It is Windows-first today, sealing secrets with DPAPI (the Windows Data Protection API), with a documented hardware-TPM upgrade path. It is self-hosted, so your keys never touch our servers.
No. The current same-user launcher cannot contain a malicious or fully compromised child process. Treat Airlock as a research preview that reduces accidental credential exposure, not as a sandbox or production-grade security boundary.
A vault stores secrets and hands them to your app. Airlock keeps the secret inside a local injecting proxy instead. It is not an OS network sandbox: clients must use the proxy, or you must add an OS-enforced egress boundary.
Yes, Apache-2.0 and self-hosted; ClassEve does not receive your keys. Self-hosting does not turn the current research preview into a same-user isolation boundary. The source is at github.com/classeve-public/credential-airlock.