Started with a problem I kept hitting. I’d point a coding agent at a project that talks to Stripe, and to get anything working I had to hand it a live key. Sitting in .env, in the environment, readable by the agent and every process it spawns. One echo from the chat log, one curl from anywhere, and still valid long after I closed the terminal. But the agent never wanted the key . It wanted the effect: a request Stripe accepts. So Towel keeps the key and lends out the effect. Small proxy on localhost: the agent gets a fake key and a local URL, and the real one is swapped in on the way out, only toward the API you registered it for. Any HTTP API, several per project if you want. Your code doesn’t change. twl project add my-app twl run --project my-app – <harness-of-your-choice> Straight with you: during the session the agent can still use the API through the proxy it can still create charges. It’s not a sandbox but rather a secure way to hide your api key. What it removes is the credential itself, so nothing the agent logs, prints, or leaks is worth anything afterward. First alpha, Linux only, unaudited. Use a test key. Please try to break it. https://github.com/luciobaiocchi/twl https://luciobaiocchi.github.io/twl/ submitted by /u/Patient_Path_6809
Originally posted by u/Patient_Path_6809 on r/ArtificialInteligence