AI agents
Let your coding agent ask for keys, without ever handing them over
Claude Code, Cursor and other MCP agents connect to StackHangar. They can ask you to add a key, ask to use one, or propose a key rotation. You approve each request in your browser with a passkey. The agent gets a reference ID and your answer, never the value.
How a request works
- Your agentAsks StackHangar over MCP, for example "I need the Stripe test key to run the checkout tests."
- StackHangarReturns a one-time approval link that works for 10 minutes. The agent shows it to you.
- YouOpen the link on
app.stackhangar.com, check which agent is asking and why, and approve or deny with your passkey. - Your agentChecks the request and gets "approved" or "denied", plus a reference ID to the item. Never the value.
app.stackhangar.com, so a look-alike page can't unlock your vault.The approval page shows the agent's name, when it was connected, how many requests it has made, the project and the agent's own description of what it needs. The page tells you to approve only if you just asked your agent for this. If you didn't, deny it or let it expire.
What an agent can do
StackHangar's MCP server gives agents seven tools. None of them returns a credential value.
| Tool | What it does |
|---|---|
list_scope | Lists the projects this agent may ask about, as opaque IDs. Project names are encrypted, so the agent never sees them. |
request_credential_entry | Asks you to store a new key. You paste the value into StackHangar yourself, where it's encrypted in your browser. The agent gets a reference to the stored item. |
request_credential_access | Asks to use a key. You pick which one, and StackHangar shows it to you, in your browser, so you can use it yourself. The agent gets a reference. |
get_request_status | Returns pending, approved, denied or expired, and on approval a reference to the item. |
propose_playbook | Proposes rotating a key, or responding to a key that may have leaked. You generate and save the new value in StackHangar. |
get_playbook_status | Returns whether you approved the playbook and which steps, if any, you let the agent run. |
report_step_result | Tells you what the agent ran for one step, done or failed, with a short note. |
An agent can't create, rename or delete projects, read item names, or list what's in your vault. It can only ask, and you answer.
Playbooks an agent can propose
An agent can propose two playbooks: rotate a key, or respond to a leaked key. It can't propose shutting a product down, because that deletes things. You approve the proposal with a passkey, and every step that touches a value runs on your device.
On Solo you can also let the agent run some steps itself: redeploy, verify that the new key works, and revoke the old key. Revoking needs your passkey again, step by step. The agent reports what it ran, and you see the report in StackHangar.
Each agent has its own identity
- One connection per agent. When an agent signs in, StackHangar opens in your browser. You name the agent, pick the projects it may ask about, and approve with your passkey. The agent then gets its own short-lived tokens, and you never copy one.
- Limited to its projects. A request for a project outside the agent's list is refused before it reaches you.
- See what's connected. The Agents page lists every connected agent, its projects, when it connected and when it was last used.
- Disconnect in one click. Disconnecting needs no passkey, so it's fast in an emergency. Anything the agent asked for that you haven't answered is cancelled.
- Everything is logged. Settings → Activity records when an agent connects or disconnects, every request it makes, every approval and denial, and every playbook step it reports. Entries are kept for a year.
- Stolen tokens get cut off. If an agent's sign-in token is reused or shows up in a different app, StackHangar disconnects that agent and logs why.
Guard rails on what agents send
- An agent's description of what it needs is shown to you as plain text. If it looks like it contains a key, token or password, StackHangar refuses the request, so an agent can't park a secret in a request by mistake.
- Once you answer, the agent's description is deleted.
- An agent can have at most 5 requests waiting for you and make 30 requests an hour.
- The MCP server refuses requests from web pages, so a site you visit can't use your agent's connection.
Keys an agent has seen
If an agent created a key itself, for example by running a provider's command-line tool, or read it from a file, it saw the value. Treat that key as exposed: rotate it so only you hold the current one. The leaked-key playbook walks you through it. Mark these keys in your vault: tick "An AI agent created or saw this value" when you edit the item, or tick it once when you paste a .env an agent wrote. StackHangar then lists them under Hygiene, rotates them first in the leaked-key playbook, and clears the mark when you save a new value. StackHangar can't tell on its own what an agent saw, so you mark it. The mark is encrypted with the item.
Keys you add through an approval link aren't in this group. You type the value into StackHangar, and the agent never sees it.
Limits, stated plainly
StackHangar keeps values out of the agent's tools. It can't control what happens to a value after you take it out of the vault.
- "Access" shows the value to you, not to the agent. When you approve an access request, StackHangar shows the value in your browser for 30 seconds so you can use it. The agent only learns that you approved.
- Once you paste a value where the agent can read it, the agent has it. That includes a
.envfile in the project, a terminal the agent uses, and the agent's chat. StackHangar can't take it back. - An agent that can run any command can read whatever its process can. If your agent runs shell commands without asking, it can read files, environment variables and terminal output that your user account can. Use the agent's own permission settings to limit that.
Our guide to giving Claude Code and Cursor API keys safely covers how to close those gaps, with or without StackHangar.
Connect Claude Code
Run this in your terminal. It has nothing secret in it, so it's safe to run anywhere, even inside an agent chat.
claude mcp add --transport http stackhangar https://app.stackhangar.com/api/mcpThen, in Claude Code, run /mcp, pick stackhangar and choose Authenticate. StackHangar opens in your browser: name the agent, pick its projects and approve with your passkey.
Connect Cursor and other MCP clients
Add https://app.stackhangar.com/api/mcp as a remote (HTTP) MCP server. Clients that support MCP sign-in open the same approval page in your browser.
If your client can't sign in through the browser, the Agents page can create a manual token instead. It's a long-lived secret you paste into the client's settings, so keep it out of agent chats, code and shared notes. Anyone with it can still only ask: you approve each request with your passkey.
Plans
Free includes 1 connected agent, and that agent can propose playbooks. Solo has unlimited agents and lets them run the redeploy, verify and revoke steps you allow. See pricing.