Keep your coding agents. Keep secrets out of their context.
Claude Code, Codex and Cursor route through NymGate. Prompts, tool-call arguments and tool results are transformed; the agent still runs on the real values locally.
> fix the failing deploy that ⟦PERSON:C410:0001⟧ reported on staging ● Read(.env.staging) DATABASE_URL=postgres://deploy:⟦SECRET:C410:0002⟧@⟦HOST:C410:0003⟧:5432/app STRIPE_KEY=⟦SECRET:C410:0004⟧ ● The deploy fails because the payment key in .env.staging was revoked. Rotate ⟦SECRET:C410:0004⟧.
What is protected
Every hop of the agent loop.
Prompts
What the developer asks
Names, customer IDs and tickets pasted into the session.
customer C-0048213→ ⟦CUSTOMER_ID⟧
Tool calls
What the agent runs
Arguments are transformed on the way out and restored before they run locally.
psql -h db-core-07.corp→ -h ⟦HOST⟧
Tool results
What the agent reads
File contents, logs and command output are transformed before they reach the model.
STRIPE_KEY=sk_live_51H8…→ STRIPE_KEY=⟦SECRET⟧
Streaming
What comes back
Text and tool input are restored as they stream, even when a token is split.
⟦PERSON:C410:0001⟧→ Mehmet Kaya
Rollout
Centrally managed. Developers keep their tools.
- Managed settings point each agent at NymGate
- API-key profiles per team, project or app
- Enterprise routing and provider policy in one place
- Detects identifiers, credentials, secrets and your own patterns
- Upstream provider keys stay on the gateway
Claude Code · managed-settings.json
{
"env": {
"ANTHROPIC_BASE_URL": "https://nymgate.corp.internal"
},
"apiKeyHelper": "/usr/local/bin/nymgate-key"
}Codex · config.toml
model_provider = "nymgate" [model_providers.nymgate] name = "NymGate" base_url = "https://nymgate.corp.internal/v1" env_key = "NYMGATE_KEY"
What it covers
Protected
- Prompts and system text
- Tool-call arguments
- Text tool results
- Streaming replies and tool input
Rejected, never sent raw
- Images, PDFs and screenshots
- Provider-hosted server tools
- Unknown content block types
- Input over the protected limit
Don't block AI. Control what leaves.
Give employees and developers the AI tools they already use, without treating every prompt as safe by default.