Skip to main content
abadge gives teams a single place to store credentials, decide which AI agents can use them, and see exactly what happened. Instead of scattering API keys across environment variables or giving agents broad access to a vault, abadge puts a policy-checked, audited gateway between every agent and every credential.

​
How it works

1

Store

Credentials live in abadge encrypted at rest. Pick zero-knowledge mode (the server never sees plaintext) or server-managed mode (server-side AES-256-GCM, accessible to remote agents).
2

Permission

Every agent must be explicitly granted access to each credential, scoped to a specific capability and optional expiry. No wildcards.
3

Deliver

Pick the delivery mode: env-var injection, file mount with 0600 permissions, or direct reveal over HTTPS. MCP tools never expose raw secrets to the LLM.
4

Audit

Every access attempt — allowed or denied — is appended to an immutable audit log with the agent, item, capability, delivery mode, and outcome.

​
Surfaces

The same control plane is available through five interfaces:

Dashboard

Operator UI for managing credentials, agents, permissions, and audit.

CLI

Local binary that injects secrets into any command via abadge run.

API

JSON REST control plane on Cloudflare Workers, with a TypeScript SDK.

MCP server

Model Context Protocol tools that use secrets without leaking them to the model.

​
Where to go next

Why abadge

The problem agents create with credentials, and what abadge does about it.

Quickstart

Install the CLI, store a secret, register an agent, grant access in five minutes.

Architecture

System design, surfaces, trust boundaries, and the four-layer model.

Security model

Encryption, auth, authorization, audit, and what a server breach exposes.