Stashbase

About Stashbase

Stashbase is a secrets control plane built for a situation most secret managers were not designed for: a coding agent that needs to call an authenticated API but should never hold the credential. For humans it does the ordinary thing well — pull the environment a service actually needs instead of passing .env files around a team, with per-environment access, invitation domains, a secrets changelog and role-based control over who can read what. The part that is unusual is the agent path. You write a profile file into the repository — a TOML document that names the project, the environment, the hosts the agent is allowed to reach, and, per secret, which hosts, methods and URL paths that credential may be exchanged against. Then you run the agent behind a proxy. The agent receives short-lived placeholders instead of values, each secret is swapped in only at the approved destination, and every allowed or denied exchange is written to a metadata-only log you can read afterwards. The proxy runs on your machine or on Stashbase infrastructure, which lets you place the trust boundary where your team wants it rather than where the vendor put it. An MCP server exposes environment context and lets a tool draft operational changes for review without the protocol ever carrying a secret value, and a secret-detection CLI scans code and pre-commit hooks so an exposed key gets replaced before it reaches production.

Key Features

Tags