The broker

An AI coding agent that can run commands can print any credential in its reach. The usual answer is a blocklist of ways to print an environment, and that list is not enumerable: an interpreter one-liner, a script's error output, a tool logging its own config, a test fixture. The fix is absence. The agent never holds a key; something beside it does, and every outbound call goes through that something.

That something is a small service listening on a Unix socket. A caller sends an ordinary HTTP request — POST /tavily/search — carrying nothing secret. The broker reads the caller's identity from the kernel, matches the first path segment to a configured key, checks that this caller may use it, checks the method and path against the service's allowlist, checks the rate limit, injects the credential, forwards the request, and hands back the upstream's status, headers and body exactly as they arrived. It is a proxy, not a client library: it parses no payloads.

Nothing in the caller's reach ever holds a key. A caller cannot print, copy or exfiltrate a credential, because it never had one.