Secure access for AI agents
Connect agents to databases, servers, and APIs without handing them real credentials. Manage access to critical services, from one desktop app.
$ npm install -g agentmfa
$ mfa secret add ANALYTICS_DB
✓ saved to vault
$ mfa conn add analytics --kind pg --host db.example.com
✓ analytics ready
$ psql "$(mfa dsn analytics)"
analytics=> select count(*) from signups;
▪ ok! · 100 rows read · 0 secrets exposedConnect any agent to any tool.
AgentMFA sits between your agents and everything they reach, so they get the access they need, securely.
- Without AgentMFA: Live API tokens pasted into every agent's env file.
- Without AgentMFA: One prompt injection reads every secret at once.
- Without AgentMFA: Rotating a key means hunting through every config that copied it.
- Without AgentMFA: No record of which agent used what credential, or when.
- With AgentMFA: Secrets sealed in one vault, every call logged in one place.
Use it locally, or in the cloud.
Run on your machine, or use a hosted instance in the cloud. Your tools, keys, and activity log go wherever you choose.
Local AgentMFA
Native macOS app without any remote dependencies. Keys encrypted in your Keychain, agents talk to a local socket, and nothing leaves the machine.
Hosted AgentMFA
Connect the desktop app to a hosted AgentMFA instance in the cloud, so your tools and activity log remain accessible from anywhere.
Desktop
Native macOS app for getting started quickly. Move your keys out of .env files today.
Download for macOSCLI
Run your remote agents, servers, and CI with AgentMFA credentials.
npm install -g agentmfa
Hosted
A cloud instance for your team. Connect the desktop app with a management token.
Use it with hosted agents.
Agents that run in someone else's cloud still need to use your credentials, but they don't need to see your keys.
Anthropic Managed Agents
OpenAI Agents SDK
Frequently asked questions
Where do my keys live?
Keys are stored in an encrypted vault on the machine running the broker. For the desktop app, this is the macOS Keychain. Keys are injected into requests on the upstream leg only and never enter an agent's context.
What does an agent actually see?
Agents can access one shared key for the machine, plus direct handles for individual connections: a password-less Postgres DSN, an SSH_AUTH_SOCK, a local HTTP endpoint per pinned API, plus a unified MCP tool.
Which agents work with it?
Anything that speaks MCP or plain HTTP: Claude, Codex, Cursor, Copilot, or your own harness with curl. Unmodified tools like psql, git, and rsync work through the broker too.
What happens when I switch a tool off?
Every agent loses access to it at once, and calls are refused with a 403 error. You can also reset all tools by rotating the shared key from the app, which disconnects everything in one step.