Introduction

Stashbase helps teams ship securely with coding agents—from development to production.

It controls what coding agents, services, and developers can reach: which credentials, API hosts, MCP tools, files, commands, and dependencies each one may use. Credentials live in Stashbase environments, and agents get placeholders instead of raw values.

Secure coding agents

Run Claude Code, Codex, and other agents in a native or Docker sandbox with governed access to credentials, network, files, and MCP tools.

Give agents the schema

Tell agents which secrets an environment expects without exposing values.

Control MCP tools

Choose which tools an agent can discover and call on each MCP server.

Protect sensitive files

Keep .env files, keys, and other sensitive paths outside the agent's reach.

Check dependencies

Check packages before an agent installs them and stop blocked dependencies.

Catch hard-coded secrets

Scan commits and pushes from developers and agents, and turn findings into reviewed fixes.

What Stashbase does

At a high level, Stashbase helps you:

run coding agents in a native or Docker sandbox with network and filesystem isolation
enforce policy for credentials, API requests, MCP tools, files, commands, and dependencies
keep raw credential values out of agent processes
give developers, services, and coding agents only the access they need, with scoped roles, teams, service accounts, and API keys
store and deliver secrets across projects and environments through the dashboard, CLI, SDKs, API, and integrations
track changes and access decisions with changelog and audit workflows
detect exposed or hard-coded secrets before they ship

Core model

Access decides who and what can use your resources:

Workspace: The top-level space for your company or team: members, teams, service accounts, billing, and shared settings.
Project: An application or service, and the unit you grant access to.
Agent profile: What one coding agent may reach: credentials per host, network destinations, files, MCP tools, and hooks. See profiles.

Secrets management holds the credentials those grants refer to:

Environment: A scoped set of credentials and config inside a project, such as production, github, or database. Apps load it, and agent profiles use it through placeholders.
Secrets: Key-value credentials and config, tracked through change history.

Platform surfaces

Use Stashbase through the interface that fits the work:

Agent Proxy for policy-controlled access to credentials, APIs, tools, files, commands, and dependencies.
CLI for running agents, local development, automation, and generating value-free environment schemas.
Dashboard for access control, secrets management, and audit workflows.
SDKs and REST API for application-side tooling and custom integrations.
MCP server for AI-assisted workflows in compatible clients.
Scanning for finding exposed or hard-coded secrets.

New to Stashbase? Start with the agent quick start to run your first sandboxed agent. Then read Who gets access for members, keys, accounts, and agents, and Secrets management for storing credentials.