Physically Unavoidable. Zero Trust.

Agents that execute code and make HTTP requests need security that doesn't depend on the agent behaving correctly. Seven mechanisms enforce that:

1. Credential broker: opaque handles instead of real OAuth tokens; credentials are injected only during the HTTP request itself.
2. Egress policy: GET is broadly allowed; POST/PUT/PATCH/DELETE are restricted to approved integration endpoints, HTTPS mandatory.
3. DNS rebinding defense: DNS resolution, IP validation, and the TCP connection happen atomically at the network stack.
4. Egress proxy: an isolated Docker container with kernel-enforced iptables rules is the sole path for outbound traffic.
5. Token scrubbing: every output boundary (LLM context, logs, tool history) is scanned to remove OAuth tokens, API keys, and JWTs.
6. WebSocket auth: connections require a signed, unexpired, org-scoped token before acceptance.
7. Container hardening: non-root execution, dropped Linux capabilities, read-only root filesystem, per-organization isolation, enforced resource limits.

Composable by design

A single request (say, posting to a calendar API) passes through several of these in sequence: egress policy validates it, the credential broker resolves the token, DNS defense checks the IP, authentication injects the credential, and token scrubbing cleans the resulting logs.

Verified, not just claimed

Secret-scanning runs in CI and pre-commit on every commit, plus a periodic full-history scan across every commit and tag, not only the current tree. This is a control you can ask to see evidence of, not just a policy statement.

Development convenience and production security are kept structurally separate: startup refuses to run with default or placeholder secrets unless a single, explicit, loudly-logged flag opts into insecure local development. There's no quiet middle setting.

Related

• Integrations: the OAuth 2.0 + PKCE model these boundaries protect
• Skills: self-built skills stay inside these same boundaries