Observed arrival · 2026-09-10

Botpasses Keeps Agent API Keys Out of the Chat

botpasses.org Observed source

Editorial interest 82/100 Selection signal · not a rating of the site

An MCP-compatible credential vault lets AI agents call services such as Stripe, Slack, and GitHub without exposing the underlying API key to the model.

Landing page captured for the 2026-09-10 issue.

Field notes

The workflow separates the model-visible request from the API-facing request: the agent supplies a URL and task description, while the vault applies a credential only after operator approval and a host check. The example uses an eight-digit approval code and restricts a Stripe credential to api.stripe.com. The page documents three operating modes—hosted, local SQLite, and self-hosted with Postgres—and says the project is MIT-licensed and free during beta.

Observed signals

Read the marks

Editorial observations of this landing page, not a rating.

○OpenPublic substance visible

⊠LoginAccess appeared gated

✦PrettyNotable craft visible

●ProPolished or operationally mature

◎NicheUnusually specific use

ƒJavaScriptBrowser-side code central

One card from the complete issue

All Approaches to Piccadilly

405,063 arrived 1,000 judged 997 catalogued Enter the complete issue