AI-AgentSeal

AI-AgentSeal: Encrypted message envelopes for multi-agent AI systems 

The problem

Your agents are passing secrets to each other through the LLM context window.

Every API token, session cookie, extracted PII field, and intermediate credential that flows from Agent A to Agent B passes through a model provider's logs, an orchestrator that sees everything, or a shared secret store where one compromised agent compromises the entire fleet.

You already know this is wrong. You did it anyway because the alternatives were worse:

• Shared secret store (Vault, etc.) — every agent authenticates to the same place. One breach, total compromise. Plus you're now running a stateful service just to move a token from one process to another.

• Plaintext through the orchestrator — the orchestrator sees everything. It becomes the single point of trust and the single point of failure.

There is no lightweight, stateless, pairwise way for two agents to exchange a secret without a third party seeing it.

Until now.

What AgentSeal is

AgentSeal is a thin convention layer that turns encrypted files into message envelopes between distrusting agents. Each agent holds a short-lived keypair. To send a secret to another agent, you write a structured file, encrypt it, and drop it anywhere, a queue, a shared filesystem, an HTTP endpoint, a Git commit. The recipient decrypts. Nobody else can read it. Not the orchestrator. Not the message bus. Not the model provider. It is not secret storage. It is secret transport.

Why it works

Pairwise, not shared. Agent A encrypts to Agent B. Agent C cannot read it. There is no shared trust anchor to compromise.

Stateless. No server. No session. No lease. Just files. If the transport is down, nothing breaks, the envelope waits.

Transport-agnostic. Agentseal doesn't care how the file moves. Use whatever you already have: Redis, S3, Git, HTTP, a shared volume, carrier pigeon.

Metadata-aware routing. Because Agentseal encrypts values but leaves keys readable, routers can inspect _meta without decrypting payload. You get intelligent routing and end-to-end confidentiality.

Auditable. Envelopes are files. Files can be version-controlled, diffed, logged, and reviewed, without exposing their contents.

Composable with MCP. Your MCP server holds the agent's age key, decrypts envelopes on demand, and never exposes plaintext to the LLM. The agent uses secrets; it never knows them.

What AgentSeal is not

• Not a secret store. It moves secrets; it doesn't keep them.

• Not a replacement for Vault. If you need rotation, dynamic credentials, and fine-grained RBAC, use Vault. If you need two agents to exchange a token without a third party seeing it, use AgentSeal.

• Not for high-frequency chatter. This is a CLI invocation, not an in-memory call. If you need sub-millisecond agent-to-agent messaging, this is the wrong tool.

• Not magic. There is no replay protection, no delivery guarantee, and no key discovery. Those are the transport layer's job, and we tell you so upfront.

Who this is for

• Multi-agent framework builders who need a trust boundary between agents.

• Security teams who are watching agents pass plaintext secrets through LLM context windows and want it to stop.

• Platform engineers running GitOps who want agent secrets in the same auditable, version-controlled pipeline as everything else.

• Anyone who has ever typed os.environ["API_KEY"] = other_agent.api_key and felt bad about it.

Get started

bash

# Generate an agent identity

agentseal init --name agent-a

# Seal a secret for another agent

agentseal seal payload.yaml --to agent-b.pub

# Open a sealed envelope

agentseal open envelope.sealed.yaml --key agent-a.key

# Run a command with secrets injected, never persisted

agentseal run --envelope envelope.sealed.yaml -- python do_the_thing.py

AgentSeal: because your agents shouldn't have to trust each other to work together. 

No server. No vendor. No plaintext.