allowlist (add / list / remove)

Configure zero-trust domain egress policies for the credential proxy and AI agents.

Subcommands

agentsecrets allowlist add

Authorize one or more outbound domains for proxy secret injection.

agentsecrets allowlist add api.stripe.com api.openai.com

agentsecrets allowlist list

Display all authorized egress domains for the current workspace.

agentsecrets allowlist list

agentsecrets allowlist remove

Revoke an authorized domain from the workspace allowlist.

agentsecrets allowlist remove api.stripe.com

Security Model

• Pre-Resolution Enforcement: The credential proxy validates the target domain against the allowlist before resolving any secret from the keychain.
• SSRF & Prompt Injection Prevention: AI agents cannot redirect credentials to unauthorized endpoints.
• Strict Subdomain Matching: Wildcards are disallowed (api.stripe.com does not permit evil.api.stripe.com).