Towel
Opens one authorized project record before launching the agent.
real keys · fixed URLs
Experimental · macOS + Linux
Let the agent run the app.
Keep the key out of sight.
Towel is a small credential broker for projects operated by coding agents. One named project holds multiple protected routes. The child gets fake keys and loopback URLs; real keys stay in the trusted parent and reach only their fixed services.
Apache-2.0 · Keychain or age vault · no TLS interception
PROJECT CREDENTIAL ARMOR
$ twl project add my-app
# interactively add one or more HTTPS Bearer routes
$ twl run --project my-app -- codex
# authorize once with Touch ID or the Linux vault password
# Inside the agent process
$ printenv APP_API_KEY
twl-app-N7m...fake
$ python app.py
✓ authenticated through the fixed upstream
PROTECTED STORAGE
LOOPBACK ONLY
FIXED DESTINATION
REAL KEYS STAY HIDDEN
01 / Architecture
One small process boundary
No provider catalog or custom cryptography. A macOS Keychain record or Linux password-encrypted age vault binds every project route to its credential and exact destination.
Agent + app
Uses normal environment-based application configuration.
twl-app-… · 127.0.0.1
Project service
Receives the request with real Bearer authentication.
HTTPS · no redirects
Zero real key in the child
Stored values and destinations are never supplied through child environment variables, arguments, plaintext files, or descriptors.
Destination stays fixed
Repository-controlled files cannot redirect where the broker places authentication.
Small enough to inspect
A focused Rust binary with route-binding regressions, a demo-only request budget, and explicit limitations.
02 / Security boundary
Useful protection, precise claims
✓ Towel protects
- Real project keys and destinations from the child environment
- Trusted-store destinations from workspace edits
- Authentication from hostile client headers
- Direct plaintext and common-Base64 key reflection
× Towel is not
- A sandbox or general-purpose secret manager
- Protection for the agent's own model login
- A guard against actions performed through the broker
- Protection from an authorized upstream that transforms or exposes a key
03 / Try it safely
No real key required
The demo creates a canary credential and a local service, then runs the same Python application contract used by a real session. This canary demo works cross-platform; real project sessions use a protected macOS binary or the Linux password-encrypted age vault.
No account, no credential, no install — the demo generates both sides.
Build + canary demo
bash$ cargo build --locked
$ ./target/debug/twl demo \
--config examples/towel.yaml \
-- python3 examples/application_client.py
{"app":"ok","authenticated":true}
04 / Install
Static binaries, verified
Prebuilt musl binaries for x86_64 and aarch64 are statically linked, so they run on any distribution with nothing else installed. Bubblewrap is optional and only adds vault masking. Every archive carries a build-provenance attestation — check it before you trust a security tool you downloaded.
The first alpha publishes Linux artifacts only. macOS runs from a signed local build until its Developer ID path is verified.
Install + verify
bash# download from the releases page, then
$ tar xzf twl-*-x86_64-unknown-linux-musl.tar.gz
$ gh attestation verify twl-*/twl \
--repo luciobaiocchi/twl
✓ verified provenance
$ sudo install -m755 twl-*/twl /usr/local/bin/twl
$ twl doctor
encrypted Linux project sessions: available
A small literary nod
Why a towel?
Douglas Adams made the towel an icon of lightweight, improbable usefulness. This one is similarly unassuming: keep it beside your agent, put the dangerous credential behind it, and don't panic.
Open by design
Help make the boundary sharper.
Towel is Apache-2.0 licensed. Security reviews, adversarial tests, and focused integrations are especially welcome.