s-gw
Star on GitHub
Why give AI the key to your kingdom?

Local credential control for AI coding agents

Raw credentials stay on your machine. Agents get typed handles, local approvals, local execution, and sanitized output.

Install with npm

Node.js 20+ ยท macOS, Linux, and Windows

Overview

Real-time security posture and usage overview

Operational readiness

Local daemonRunning
KeychainUnlocked
Policy engineActive
Audit loggingEnabled

Pending approvals

0No pending approvals

Credential handles

ProviderSecretsSeverity
Keychain33Medium
API Tokens2Low
Credentials1Low
1Password12Low

Policy coverage

17Enabled rules
9 allow5 ask3 deny

Usage Flow

AgentAuthentication typeTarget typeCodexClaude CodeCursorOpenCodeGemini CLIWindsurfAWS access keySSH private keyGitHub tokenAI API keyDatabase passwordMCP session tokenService account keyDocker registry tokenAWS APISSH serverGitHub repositoryModel APIDatabaseLocal commandNAS / applianceContainer runtimeWeb API

Recent activity

SourceEvent typeStatusDestination
CodexRequestPendingweb-prod-01
Claude CodeRequestExecutedThis Mac
OpenCodeRequestDeniedThis Mac
CodexRequestApprovedAWS
CursorRequestExecutedThis Mac
Gemini CLIRequestPendingThis Mac
WindsurfRequestPendingpreview-host
View all activity

The security boundary

The agent gets a handle. Never the credential.

s-gw never returns plaintext to the coding agent. The model can request an approved action, but it cannot read, print, copy, or return the secret behind the handle. That means the credential cannot leave your computer through model context, prompts, or tool responses.

Agent receivesTyped handles-gw:credential:prod-readonly
s-gw resolves locallyApproved execution

Raw credential stays inside this boundary

Agent receives backSanitized result

Secret values removed before return

What authorization releases

A use is safer than a secret.

1Password CLI documentation
Runtime secret injection

Plaintext enters the authorized runtime.

s-gw handle mediation

The agent never receives the raw value.

How it works

Patent-pending methodology

Credentials stay local. Useful work comes back.

The agent requests an action with a typed handle. s-gw approves, resolves, executes, and sanitizes it inside one auditable loop on your machine.

Local control surfaces

Review every request before execution.

See the exact agent, credential, command, policy, and destination before deciding how long access should last.

Interactive demo
Approval needed
Codex wants to use a local credential handle.
Pending
CodexRequesting agent
AWS access keyproduction-readonly
AWS APIsts:GetCallerIdentity
Agent
Codex
Action
aws sts get-caller-identity
Target
AWS production
Authentication
AWS access key - production-readonly
Handle
s-gw:credential:prod-readonly
Risk
Medium
Policy
User approval required

Tracked locally

Every agent credential use becomes an audit event.

s-gw records which agent asked, which handle was used, where it ran, how it was approved, and whether the result was sanitized before returning to the agent.

630
Credential events
6
Tracked agents
49
Local handles
0
Raw secrets returned
Credential usage map
Demo seven-day flow from agents to authentication types to target types.
demo data
Agent credential usage flowAgents flow into authentication types and then into local target types tracked by s-gw.AgentAuthentication typeTarget typeCodex 204 requestsCodex204 requestsClaude Code 146 requestsClaude Code146 requestsCursor 112 requestsCursor112 requestsOpenCode 84 requestsOpenCode84 requestsGemini CLI 48 requestsGemini CLI48 requestsWindsurf 36 requestsWindsurf36 requestsAWS access key 150 requestsAWS access key150 requestsSSH private key 134 requestsSSH private key134 requestsGitHub token 103 requestsGitHub token103 requestsAI API key 82 requestsAI API key82 requestsDatabase password 62 requestsDatabase password62 requestsMCP session token 39 requestsMCP session token39 requestsService account key 33 requestsService account key33 requestsDocker registry token 27 requestsDocker registry token27 requestsAWS API 150 requestsAWS API150 requestsSSH server 112 requestsSSH server112 requestsGitHub repository 103 requestsGitHub repository103 requestsModel API 82 requestsModel API82 requestsDatabase 62 requestsDatabase62 requestsLocal command 49 requestsLocal command49 requestsNAS / appliance 30 requestsNAS / appliance30 requestsContainer runtime 27 requestsContainer runtime27 requestsWeb API 15 requestsWeb API15 requests
AgentAuthentication typeTarget type
Route details
Representative local audit routes from the demo flow.
RequestOutcome
Codexs-gw:credential:aws-prod-deployAWS access key -> AWS API
82 uses
Codexs-gw:private-key:agentsec-webSSH private key -> SSH server
27 uses
Codexs-gw:private-key:nas-adminSSH private key -> NAS / appliance
15 uses
Codexs-gw:api-token:model-evalAI API key -> Model API
34 uses
Codexs-gw:api-token:release-botGitHub token -> GitHub repository
24 uses
Stored raw secretsnever in logs
Approval scopeone-time, timed, or policy
Sanitized outputhandle tokens only

Activity log

Open any event. See the complete path.

Every entry connects the original request to the agent, action, security decision, and final destination without recording the raw secret.

3 recent events
Activity log
Select an entry to inspect its request and security-control details.
3 events
SourceEvent typeStatusEvent IDDestinationReason codeRule nameDate & Time
CodexRequest ApprovedApprovedevt_req_7f2a1cAWS APIUser approvedProduction read onlyJul 2, 11:38 PM
SourceCodex requestAgent request
Reason:
Verify production caller identity
Posture:
Approved
Connection:
Shell command
AgentCodexRequesting agent
Name:
Codex
Status:
Approved
Tool called:
aws sts
Actionaws stsApproved
Kind:
Command
Command:
sts get-caller-identity
Credential:
production-readonly
Security ControlsAllowedApproved
Event:
Request Approved
Action:
Approved
Reason:
User approved
DestinationAWS APIAmazon Web Services
Target:
AWS API
Provider:
Amazon Web Services
Handle:
prod-readonly

Built for developers

Supported agents

Use s-gw with the coding agents already in your workflow.

OpenClaw
ZeptoClaw
Claude Code
Codex
Hermes Agent
Cursor
Windsurf
Gemini CLI
GitHub Copilot CLI
OpenHands
Antigravity
OpenCode
OmniGent
VS Code / Copilot Agent Mode
And many more

Native surface

Approval stays within reach.

The macOS app, menu-bar helper, local console, and CLI all read the same local store. Raw secret values stay in Keychain or the local encrypted ledger.

macOS Keychain-backed credential storage
Typed handles instead of raw secret values
Approval policies for commands, agents, and time windows
Local audit trail for request, approval, and execution events
macOS app
Credential handles, approvals, agents, policies, activity, and audit.
KeychainReady
Pending1 approval
Agents6 supported
AuditLocal only
Guard mode
Launch agents with credential-looking env values replaced by handles.

s-gw run codex --dry-run -- -v

s-gw run codex -- --ask-for-approval never

Install with npm
The recommended path for macOS, Linux, and Windows. Requires Node.js 20 or newer.
local-first

Copy and run in Terminal

npm install -g @s-gw/s-gw
s-gw setup

Desktop downloads

Prefer a desktop download?

npm is the recommended route. These packages are available if you prefer a desktop download.

Choose a platform

macOS appWindows (preview)

Keep agent credentials useful. Keep them local.

Install with npm, then see how each request stays local.

Install with npm

Give s-gw a star on GitHub

Star on GitHub