sgateway/s-gw

Local credential control for coding agents.
Approve bounded actions locally. Keep raw credentials out of model context and tool output.
Demo ·
Downloads ·
Quick start ·
Documentation ·
Security ·
Contributing
Stop handing raw credentials to coding agents. s-gw gives agents typed handles, asks you to approve bounded local actions, resolves the credential inside a constrained process on your machine, and returns sanitized output instead of secret values.
> [!IMPORTANT]
> s-gw is an early preview. Storage formats and interfaces may change, Windows and Linux desktop support is still experimental, and the project has not completed an independent security audit. Do not treat it as a replacement for endpoint security or a hardened enterprise secrets platform yet.
>
> The TypeScript broker, clients, and documentation in this repository are Apache-2.0 licensed. Distributed packages also contain a proprietary compiled Rust execution core whose source is maintained separately.
The Short Version
- **Agent sees:** s-gw:credential:prod-readonly
- **You approve:** agent, command, handle, environment binding, working directory, and target
- **s-gw runs:** the command locally with the credential injected only into that child process
- **Agent receives:** sanitized output, audit evidence, and no raw secret
If s-gw helps your agent workflow, star the project. It makes the preview easier for other developers to find.
See It In Action
The local console shows the approval queue, credential inventory, policy state, usage flow, and activity history without exposing secret values.
Public demo: s-gw.com.
What It Does
| Govern | Approve | Execute | Audit |
| --- | --- | --- | --- |
| Turn secrets into typed local handles that agents can reference safely. | Review the requesting agent, handle, command, environment binding, working directory, and target before access is granted. | Inject the credential only into the approved child process on the same machine. | Record request, approval, execution, policy, and destination evidence without storing returned raw secrets. |
Why Teams Use It
- **Local custody:** raw values stay in macOS Keychain, Linux Secret Service, Windows Credential Manager, 1Password, or the encrypted local ledger.
- **Action-scoped access:** grants bind to the agent, handle, command, environment variable, working directory, target, approval mode, and optional time window.
- **Useful handles:** agents can request real work with stable handle names instead of seeing keys, passwords, tokens, or SSH material.
- **Output sanitization:** command output is scanned before it returns to the agent, replacing detected credential values with handles.
- **Agent-aware setup:** Codex, Claude Code, Cursor, OpenCode, Gemini CLI, GitHub Copilot, VS Code, and other MCP clients get profile-specific configuration.
- **Local operator UI:** native desktop apps, tray or menu helpers, the CLI, and the web console show approvals, credential inventory, policies, usage flow, activity, and audit history.
How It Works
The agent never needs the unlock passphrase or raw credential. Approval is scoped to the requested operation rather than granting general access to the store.
Core Surfaces
| Surface | Purpose |
| --- | --- |
| s-gw CLI | Setup, credential enrollment, approvals, policies, agent snippets, guard mode, and diagnostics. |
| s-gw-mcp / s-gw mcp | Stdio MCP server for agent-facing handle discovery and request creation. |
| Native macOS app | Approval queue, credential inventory, policy rules, usage flow, activity, and audit review. |
| Windows and Linux desktop apps | Installed preview apps with a native window, tray controls, and a bundled local runtime. |
| Menu-bar helper | Fast visibility into pending approvals and local daemon status. |
| Local web console | Browser backup bound to 127.0.0.1; it remains available when a desktop app cannot run. |
| Guard mode | Launch agents with credential-looking environment values replaced by s-gw handles. |