Node.js

@stashbase/agent-proxy is a Node.js 20+ library for applications that build their own AI agents. It gives agent tools a placeholder instead of a real credential, then injects the credential only into an authorized outbound request.

Install it with your preferred package manager:

npm add @stashbase/agent-proxy

Quick start

The trusted application resolves the secret and creates the policy. The tool receives only ${STASHBASE_GITHUB_TOKEN} through proxy.placeholders or proxy.childEnv; it never receives the token value.

import { AgentProxy } from '@stashbase/agent-proxy'

const proxy = new AgentProxy({
  egressHosts: ['api.openai.com'],
  bindings: {
    GITHUB_TOKEN: {
      // Resolve this in the trusted application.
      secret: process.env.GITHUB_TOKEN!,
      hosts: ['api.github.com'],
      header: 'authorization',
    },
  },
})

await proxy.start()

try {
  console.log(proxy.placeholders.GITHUB_TOKEN)
  // ${STASHBASE_GITHUB_TOKEN}
} finally {
  await proxy.stop()
}

The library is standalone, but pairs well with @stashbase/node-sdk: use the SDK in the trusted application to resolve a secret, then pass that value to the Agent Proxy binding. The proxy is responsible for the short-lived local credential boundary.

Next steps

• Read the complete Agent Proxy library guide
• Configure a Stashbase Node.js client
• Run an existing coding agent with the CLI

See the published package on npm.