Pinned
Your coding agent can see your API keys.
All of them.
Stashbase gives agents placeholders instead. Real keys stay behind a proxy, and each one only works where you allow it.
Try it locally in 2 min → stashbase.dev
00:00
stashbase.dev
@stashbase
Ship securely with coding agents—from development to production. Stashbase scopes agent access to credentials, APIs, tools, files and more.
- Claude Code can write to Linear but can't read it. Rules on MCP tool calls, down to the arguments. 🔒00:00
- We’ve added HTTP body and MCP argument rules to Stashbase. Let an agent create GitHub issues with the "agent" label. Block extra labels or assignees. Control the fields and values it can send, enforced by the proxy.
- A coding agent should be useful without access to your .env or unrestricted internet. This demo runs Claude Code in a Docker sandbox: .env blocked arbitrary sites blocked GitHub allowed The access profile decides what the agent can reach.00:00
- A coding agent should not be deciding its own permissions. Give it a profile that decides what it can access: - files - network -credentials - MCP tools Then let it work freely inside that boundary. Prompts and approval dialogs still have a place. But they are not
