skills.rest
bshandley
bshandleyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

gatehouse

Route credential access through the Gatehouse vault to keep secrets out of agent context.

5|1|Updated Apr 10, 2026
Search Tags:#onboarding#secrets#credentials#vault#proxy#dynamic-secrets#gatehouse
One-click install
npx skills add https://github.com/bshandley/gatehouse --skill gatehouse
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gatehouse
Source: https://github.com/bshandley/gatehouse/tree/main/src/templates
Command: npx skills add https://github.com/bshandley/gatehouse --skill gatehouse

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Gatehouse centralizes credential access, ensuring secrets never enter an agent's context by proxying authentication and injecting credentials server-side.

Core Features & Use Cases

  • Proxy mode routes API calls through Gatehouse, keeping secrets out of agent memory.
  • Dynamic secrets manage short-lived SSH/DB credentials with automated rotation.
  • Onboarding and auditing support seamless integration across Hermes, Claude Code, and other runtimes.

Quick Start

Install Gatehouse, exchange the bootstrap token to obtain a JWT, and fetch the skill body to enable policy-driven secret routing.

Frequently Asked Questions about gatehouse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent API credentials from entering my AI agent's context?▼

To prevent API credentials from entering agent context, route all credential access through a proxy vault. Gatehouse injects secrets server-side, ensuring sensitive data never loads into the agent's memory.

How do I manage dynamic secrets for SSH and database credentials in AI workflows?▼

Manage dynamic secrets for SSH and database credentials by routing them through a vault proxy. This approach handles short-lived credentials with automated rotation, maintaining security across MCP and HTTP endpoints.

Do I need a specific vault deployment to use proxy mode for AI agent authentication?▼

Yes, proxy mode requires a Gatehouse deployment with AppRole login, utilizing a role_id and secret_id. You must also exchange a bootstrap token to obtain a Bearer JWT for authenticated tool calls.

Can I use this credential proxy with Claude Code and Hermes runtimes?▼

Yes, the credential proxy supports onboarding and auditing for seamless integration across various runtimes including Claude Code and Hermes, allowing policy-driven secret routing without exposing keys.

What is the best way to secure API proxy flows across MCP and HTTP endpoints?▼

The best way to secure API proxy flows across MCP and HTTP endpoints is centralizing credential access. A server-side vault injects authentication dynamically, preventing static keys from leaking into requests.

Why does my AI agent need policy-driven secret routing for tool calls?▼

AI agents need policy-driven secret routing to isolate authentication from application logic. By proxying credential access via a vault, you enforce strict boundaries and prevent unauthorized secret exposure.

Related Skills

Explore More Software Engineering Skills→
mattbutlerengineeringmattbutlerengineering
1

auth-package

Integrate OIDC authentication into React frontends and protect Fastify routes with JWTs.

Community
Intermediate
markus41markus41
1

atlassianapi

Automate Jira and Confluence workflows via Atlassian REST APIs.

Community
Intermediate
cenjiecenjie

secrets-management

Manage and rotate credentials in CI/CD pipelines across Vault and AWS Secrets Manager.

Community
Advanced
tharunramagiritharunramagiri

init-onecli

Migrate API credentials from .env files into the OneCLI Agent Vault.

Community
Advanced