Show HN: I built a way for coding agents to use secrets with O seeing them
A developer created Secret Shuttle, a tool that allows coding agents to use secrets (like API keys) without the agents themselves being able to see those secrets. This helps maintain security when giving AI coding assistants access to sensitive credentials.
Background
- **Secret-shuttle** is a new open-source tool (on GitHub) that lets AI coding agents (like Cursor, Copilot, or custom LLM agents) use API keys, passwords, or tokens without the agent itself ever seeing the plaintext secret.
- The problem it solves: today, when you give a coding agent access to secrets, the agent (or the cloud service behind it) could potentially leak, log, or misuse those credentials. Secret-shuttle acts as a local proxy — the agent sends a *request* to use a secret, and the shuttle injects it at runtime, blinded to the agent.
- **Key context**: AI coding agents are becoming widely used to write and deploy code, but security-conscious developers worry about handing over sensitive credentials. Tools like this are part of a broader push for "agent-safe" infrastructure — keeping secrets out of model context windows and logs.
- The creator (pdumicz) posted this as a "Show HN" on Hacker News, indicating it's a personal project seeking feedback from the developer community.