Home

🛡️ AgentCordon

Secure credential brokering and policy enforcement for autonomous AI agents

---

AgentCordon sits between your AI agents and the secrets they need. Agents never hold long-lived credentials — instead, they authenticate with Ed25519 challenge-response, request credentials through Cedar policy checks, and receive per-request ECIES-encrypted envelopes that only their private key can decrypt.

---

✨ Key Capabilities

	Capability	Description
🔐	Zero-Trust Credential Vending	Credentials encrypted at rest (AES-256-GCM), vended via ECIES — agents never see raw secrets
🌲	Cedar Policy Engine	Fine-grained authorization with deny-by-default, tag-based access, and per-tool granularity
🔌	MCP Server Bridge	Proxy MCP tool calls across workstations with automatic credential injection
🔑	Ed25519 + P-256 Identity	Challenge-response auth with short-lived JWTs — no passwords, no API keys
📋	Full Audit Trail	Every credential vend, policy decision, and tool call is logged with correlation IDs
🏗️	3-Crate Rust Architecture	Core library + control-plane server + gateway CLI, backed by SQLite or PostgreSQL

---

🚀 Quick Start

# 1. Start the server
docker compose up -d

# 2. Install the CLI
curl -fsSL https://your-server:3140/install.sh | sh

# 3. Enroll a workspace
agentcordon init --server https://your-server:3140

# 4. Proxy an API call with injected credentials
agentcordon proxy github-token GET https://api.github.com/user

Tip

For CI/CD environments without a browser, use provisioning tokens: agentcordon init --server <URL> --token <TOKEN>

---

📚 Documentation

Getting Started

Page	Description
Workspace Enrollment	How agents establish identity — Ed25519 keypairs, PKCE registration, provisioning tokens
Granting MCP Server Access	Connect workspaces to MCP servers across machines with Cedar policies
Upgrading	Zero-downtime upgrades for server and CLI — migrations, backups, rollback

Architecture & Security

Page	Description
System Architecture	3-crate overview, API routes, middleware, data flow diagrams
Master Key	HKDF-SHA256 key derivation, zeroization, nonce safety, key rotation
Credential Encryption	AES-256-GCM at rest, ECIES vending, credential transforms, SSRF protection
Authorization & Cedar Policy	Entity types, actions, deny-by-default, default policy walkthrough

Reference

Page	Description
CLI Reference	Complete command reference — init, proxy, mcp-serve, and all flags

---

🏛️ Architecture at a Glance

┌─────────────────────┐         ┌──────────────────────────────┐
│   AI Agent          │         │   AgentCordon Server (:3140) │
│   (Claude, Cursor)  │         │                              │
│                     │         │  ┌────────────────────────┐  │
│  ┌───────────────┐  │         │  │  Cedar Policy Engine   │  │
│  │ agentcordon   │  │ Ed25519 │  │  (deny-by-default)     │  │
│  │ mcp-serve     │◄─┼─────────┼─►│                        │  │
│  │               │  │  ECIES  │  │  AES-256-GCM Vault     │  │
│  └───────┬───────┘  │         │  │  ES256 JWT Issuer      │  │
│          │          │         │  └────────────────────────┘  │
│          │ JSON-RPC │         │                              │
│  ┌───────▼───────┐  │         │  ┌─────────┐ ┌───────────┐  │
│  │ MCP Server    │  │         │  │ SQLite  │ │ Postgres  │  │
│  │ (subprocess)  │  │         │  └─────────┘ └───────────┘  │
│  └───────────────┘  │         └──────────────────────────────┘
└─────────────────────┘

---

🔧 Environment Variables

Key server configuration — see System Architecture for the full list.

Variable	Default	Description
AGTCRDN_LISTEN_ADDR	127.0.0.1:3140	Server bind address
AGTCRDN_MASTER_SECRET	Auto-generated	Root encryption secret (details)
AGTCRDN_DB_TYPE	sqlite	sqlite or postgres
AGTCRDN_SEED_DEMO	true	Seed demo data on first boot