KeylessOps

KeylessOps is a keyless operations gateway for AI agents. The agent receives a short-lived, narrowly scoped capability; the long-lived SSH key, cloud access key, API token, or cookie stays inside the broker and secret-store boundary.

中文：把“给 AI 密码”改成“给 AI 一个可审计、可撤销、最小权限的操作能力”。

KeylessOps is an early MVP. It is useful for local evaluation and controlled private deployments, but the current bearer-token control plane and encrypted local store are not a complete production identity or secret-management system.

What ships today

• A three-section credential workspace: API keys, accounts/passwords, and cloud platform keys. Save a supported connection, click Give to agent, and copy a temporary, entry-scoped call instruction. No manual secret/capability/token wiring is required. See the workspace guide / 使用说明 / 사용 안내.

• A remote MCP server over Streamable HTTP.

• Six fixed-schema, read-only operations:

  Tool	Authority exposed to the agent
  server_status	Status for a configured local/SSH server alias
  server_disk_usage	Usage for administrator-allow-listed mount paths
  server_logs	Bounded, redacted logs for allow-listed systemd units
  aliyun_instance_list	Allow-listed ECS inventory in an allow-listed region
  aliyun_instance_metrics	A bounded 24-hour metric window for one allow-listed ECS instance
  cloud_instance_list	Tencent CVM / Volcengine ECS inventory scoped to a saved connection and explicitly allowed regions/instances

• An AES-256-GCM encrypted local development store and an Infisical Universal Auth resolver for external secret custody.

• Signed, expiring, revocable agent tokens with per-tool/per-target scopes.

• A restricted credential-injection proxy bound to a fixed HTTPS origin, GET/HEAD, normalized path prefixes, response limits, SSRF defenses, and output/header redaction.

• A metadata-only audit trail. Authorized external calls and management changes require a durable intent record first; if audit storage is unavailable, the action fails closed.

• One self-contained Go binary with an embedded administrator console in English, Simplified Chinese, and Korean.

KeylessOps deliberately does not expose get_secret, raw_http_request, ssh_exec, shell, arbitrary JavaScript, raw SQL, or a Docker socket. R1–R3 mutations are disabled until server-enforced two-stage approval exists.

Trust boundary

AI agent              KeylessOps broker                 Secret store
short-lived token --> auth + policy + audit intent --> local encrypted DB
typed alias/args       fixed operation only              or Infisical
       ^                        |
       |                        +--> SSH / ECS / fixed HTTPS upstream
       +---------- bounded, allow-listed, redacted result

The agent never chooses an SSH address, username, command, cloud endpoint, credential reference, or upstream origin. Those values live in administrator policy. See Architecture and the Threat model before exposing the service to a network.

Output redaction blocks exact and common credential reflections, including chunk/limit boundaries, but it cannot recognize every encoded or fragmented transformation. A configured HTTP destination receives its injected credential by definition and must be trusted not to deliberately exfiltrate it. Prefer typed tools and SSH public-key authentication whenever possible.

Quick start

Requirements: Go 1.25+ (the module pins the current security-patched Go 1.26.8 toolchain) or Docker.

git clone git@github.com:ytvchsy/KeylessOps.git
cd KeylessOps
go run ./cmd/keylessops keygen

Export the two generated values in the broker shell, then start the service:

export KEYLESSOPS_MASTER_KEY='generated-master-key'
export KEYLESSOPS_ADMIN_TOKEN='generated-admin-token'
go run ./cmd/keylessops serve

Open http://127.0.0.1:8080, enter the administrator token, select a credential category, and add an entry. Use Give to agent to generate and copy its call instructions. Existing secrets, capabilities, token management and audit remain available under Advanced management (/advanced.html). The default policy grants no server or cloud targets; supported entries created in the workspace take effect immediately without editing that file.

For Docker Compose:

cp .env.example .env
# Fill .env with fresh values; never commit it.
docker compose up --build

The Compose port is published on loopback only. KeylessOps does not terminate TLS; remote deployments need a trusted TLS reverse proxy or private service mesh. See Deployment.

Policy

Server and Alibaba Cloud targets are declared in strict administrator-owned JSON. Empty cloud allowlists deny all access.

{
  "servers": [
    {
      "id": "broker-local",
      "transport": "local",
      "allowed_services": ["keylessops"],
      "disk_paths": ["/"]
    }
  ],
  "aliyun_accounts": [
    {
      "id": "aliyun-prod",
      "credential_ref": "infisical:/aliyun/prod#ECS_CREDENTIAL",
      "allowed_regions": ["cn-hangzhou"],
      "allowed_instance_ids": ["i-example"]
    }
  ]
}

An Alibaba Cloud credential secret is a strict JSON document containing access_key_id, access_key_secret, and optionally security_token. The official ECS SDK is constructed inside the broker only after account, region, and instance policy checks; agent input cannot select an endpoint or proxy.

Agent token scopes can be broad within policy (ops.read) or narrowed, for example:

server_status:broker-local
server_logs:broker-local:keylessops
aliyun_instance_list:aliyun-prod:cn-hangzhou
aliyun_instance_metrics:aliyun-prod:cn-hangzhou:i-example
http_proxy:github-readonly

Policy remains authoritative even when a token uses :* or ops.read. Because MVP scopes bind names rather than immutable policy generations, use versioned aliases and revoke outstanding tokens before repointing or widening a name.

Connect an MCP client

Codex can use the Streamable HTTP endpoint with a short-lived bearer token:

[mcp_servers.keylessops]
url = "https://keylessops.example.com/mcp"
bearer_token_env_var = "KEYLESSOPS_AGENT_TOKEN"
enabled = true
required = true
enabled_tools = [
  "server_status",
  "server_disk_usage",
  "server_logs",
  "aliyun_instance_list",
  "aliyun_instance_metrics",
]
default_tools_approval_mode = "prompt"

Keep sensitive reads such as logs on client approval even though they are R0. Production OAuth is on the roadmap. Full client guidance is in Codex integration.

Restricted HTTP capability proxy

The optional proxy invokes only a stored capability:

GET /v1/proxy/{capability}/{allow-listed-path}
Authorization: Bearer <short-lived-agent-token>

The corresponding token scope is http_proxy:{capability}. Caller identity, forwarding, cookies, authorization, internal redirect/file-send, and unknown headers are stripped. Redirects are not followed. Public HTTPS is required by default; private upstreams require the explicit development escape hatch.

Development

make check
make race

Security-sensitive changes should include negative tests for scope bypass, SSRF, path normalization, output limits, credential reflection, audit failure, and malformed upstream data. See Contributing and Security policy.

Production roadmap

• OAuth/OIDC workload and human identity.
• Immutable external audit storage and alerting.
• Server-enforced request/approve/execute grants for R1–R3 actions.
• Separate public MCP and private management listeners.
• Secret rotation and high-availability deployment guidance.

Licensed under the Apache License 2.0.