Zero-trust proxy for AI agents

Give agents API access without giving them your secrets.

Vertex swaps dummy credentials for real downstream tokens inside a policy-bound Rust proxy, so autonomous agents can execute work while your production secrets stay vaulted.

Start with VertexReview security model
10sDownstream timeout
ES256JWT boundary
0Secrets in agent context
POST /api/proxylive policy
Agent JWTES256 verified
Vault exchangedummy:vt_9f31
Downstreamapi.github.com
policy_id2f44...82ca
allowed_methodsGET, POST
request_hash94ad19f3c120...
http_status200
Agent platformsAI devtool teamsInternal automationSecurity engineering

No secret sprawl

Agents receive inert dummy credentials instead of production tokens.

Policy-bound egress

Every outbound call is checked against active domains and methods.

Audit by default

Each execution writes destination, status, policy, and request hash telemetry.

Serverless deploy

Rust functions run on Vercel with a 10 second downstream boundary.

Why teams buy Vertex

Agent products need credential control before they need another workflow builder.

The moment an agent can call external APIs, it needs policy boundaries, token isolation, request filtering, and audit trails. Vertex packages that layer as infrastructure.

Agent API brokerage

Let autonomous agents call GitHub, Stripe, Linear, or internal APIs without handing over raw production credentials.

Customer-controlled vaulting

Map high-entropy dummy tokens to encrypted downstream secrets scoped to a policy row.

Secure tool execution

Wrap MCP tools, workflow actions, and internal automations with verified JWT identity and host controls.

Compliance-grade audit

Record hash-first request context and reserve proof bytes for future ZK verification.

Security architecture

Built around verified identity, scoped credentials, and short-lived token exposure.

1

Agent presents ES256 JWT

Issuer, audience, expiration, and policy ID are validated before vault access.

2

Proxy resolves dummy token

Supabase policy rows bind the dummy credential to allowed domains and methods.

3

Secret swaps in memory

The real token is inserted into the downstream request and then zeroized.

4

Audit trace is committed

Telemetry stores the policy ID, host, status, hash, and proof slot.

Operational view

Policy, vault, and audit states stay visible without exposing secret material.

LayerNameDomainMethodStatus
Policygithub-productionapi.github.comGET, POSTactive
Vaultstripe-billingapi.stripe.comPOSTrotated
Auditblocked-metadatametadata.google.internalDENYblocked
Runtime profileRust 2021, Vercel serverless, 10s downstream timeout
Database profileSupabase, pg_sodium, Vault, pg_graphql migration
Crypto profileES256 JWT validation, Ed25519 internal signing
Plans

Start small, then put every agent action behind policy.

For early agent products

Developer

$99

3 policies

10k proxy calls

Community support

Talk to sales
For production workflows

Team

$499

50 policies

1M proxy calls

Priority support

Talk to sales
For regulated agent fleets

Enterprise

Custom

Dedicated policies

Private deployment

Security review

Talk to sales

Ship agent capabilities without shipping secret risk.

Put a zero-trust proxy between autonomous execution and every production API.

Request access