connect anywhere

Keep real keys out of agent chat
Use your existing framework.

Choose a guide for your team’s stack. Your software uses the service key; the agent receives only approved results. Guides cover Vercel AI SDK, LangChain, the OpenAI Agents SDK, the OpenAI Responses API, CrewAI, LlamaIndex, AutoGen, Pydantic AI, and n8n plus a native path for runtimes that speak the Model Context Protocol directly, a standard for connecting agents to tools. Start with a free account and one vault entry, then test the boundary, errors and logs before production.

01Select your framework02Resolve inside the tool03Return a safe result
the pattern

The pattern is always the same.

Three steps keep access in your software:

  1. Register a tool with the framework's tool API (tool(), the Responses API function tool schema, etc).
  2. Inside the tool's execute function, call vaultGet() (TypeScript) or vault_get() (Python) against your tenant key to resolve the credential.
  3. Make the privileged HTTPS call to the destination API inside the tool boundary. Return only the API result to the model, never the credential.

Return only the data the model needs, with the real key kept inside your trusted tool.

frameworks

Pick your framework.

Choose a framework guide or connect through MCP, the Model Context Protocol for agent tools. Adapt the example to your own permissions and data handling.

framework

Vercel AI SDK

Drop-in for generateText + tool() in any Next.js / Node project. ~30 LOC against ai + @ai-sdk/openai. Official adapter published: npm i deny-sh-vercel-ai.

TypeScript
framework

LangChain

LangChain v1 @tool / tool() wrapping a deny.sh vault entry. Works with create_agent / createAgent in Python or TypeScript. Official adapter published: pip install deny-sh-langchain / npm i deny-sh-langchain.

Python / TypeScript
framework

OpenAI Agents SDK

The official deny-sh-openai-agents adapter for OpenAI's Agents SDK runner. Resolves the credential inside the tool, fail-closed leak sweep on the return. Official adapter published: pip install deny-sh-openai-agents / npm i deny-sh-openai-agents.

Python / TypeScript
framework

OpenAI Responses API

Function-calling against the Responses API (the interface for model requests and tool calls). Resolves the credential between function_call and function_call_output; never round-trips through the model.

TypeScript / Python
framework

CrewAI

Role-based multi-agent crews. The @tool decorator (or a BaseTool subclass) resolves the credential inside _run; the crew never sees the key.

Python
framework

LlamaIndex

FunctionTool.from_defaults wrapped in a FunctionAgent workflow. Credential resolved inside the function; narrowed DTO out. Python or TypeScript.

Python / TypeScript
framework

AutoGen

Microsoft AutoGen v0.4+ AssistantAgent with plain async tool functions. The deniable resolve happens inside the tool, off the model's wire.

Python
framework

Pydantic AI

Type-safe @agent.tool with dependency injection. Tenant context rides in RunContext.deps, so the per-tenant vault password never touches the prompt.

Python
low-code

n8n

AI Agent node calling a deny-backed resolver (Code node or HTTP Request tool). Use a separate resolver if n8n itself must not receive the key.

Workflow / JS native path · no wrapper
protocol

Model Context Protocol

Already speak MCP? Skip the framework code entirely. Claude Desktop, OpenClaw, Cursor, Cline, Continue, Zed point at a deny.sh MCP server and get 10 tools, two modes, one config block. No SDK install, no agent loop to write.

JSON config
what you get

What you get from any of them.

  • Keep credentials out of model context. The model receives approved results. Your integration must keep keys out of every model-accessible path.
  • Per-tenant deniability. Each tenant's vault entry encrypts under its own keys. Cross-tenant leakage is cryptographic, not policy.
  • 365-day RFC 3161 audit chain. Every vault hit is recorded against the tenant key. Regulator-grade evidence trail out of the box.
  • Decoy tripwires. Register the SHA-256 of any decoy controlData. Receive alerts in Slack, PagerDuty, or Datadog when a registered fingerprint reaches a monitored deny.sh decryption endpoint. /dashboard/decoy-alerts.
  • Local fallback. Same four tools (deny_local_*) work with no network and no auth, so your agents keep working when our servers don't.
github

Working examples on GitHub.

The full runnable repo for each framework lives at github.com/deny-sh-crypto/deny-sh-integrations. Use the examples with your DENY_API_KEY + VAULT_PW, and test with non-production credentials. Check dependency versions and test your adapted example before production.

Get a free API key Read the agents pitch
Limits and scope

What to know before production.

The model receives approved results when your code also keeps real keys out of errors, logs and other accessible tools. This boundary does not prevent misuse of an authorised tool or compromise of its runtime. Test those paths before production.

Review evidence and current status ↗ · Threat model