Roadmap
What's built, what's next, and where we need help
Status:
✅ Live · 🔨 In Progress · 📋 Planned · ⚠️ Deprecated
Broker Endpoints
| Endpoint | Status | Purpose |
|---|---|---|
POST /secrets/get | ✅ | Fetch a secret value |
POST /secrets/list | ✅ | List available secret names |
POST /proxy/request | ✅ | Generic proxied HTTP with credential injection |
POST /api/s3/presign | 🔨 | Generate presigned S3 URLs (no keys on disk) |
ALL /api/openai/* | ✅ | Passthrough proxy to OpenAI |
ALL /api/anthropic/* | ✅ | Passthrough proxy to Anthropic |
ALL /api/github/* | ✅ | Passthrough proxy to GitHub |
ALL /api/notion/* | ✅ | Passthrough proxy to Notion |
ALL /api/gemini/* | ✅ | Passthrough proxy to Gemini |
ALL /api/cloudflare/* | ✅ | Passthrough proxy to Cloudflare |
ALL /api/brave/* | ✅ | Passthrough proxy to Brave |
ALL /api/aws/s3/* | ✅ | S3 passthrough with SigV4 signing |
seksh Commands
| Command | Status | Purpose |
|---|---|---|
seksh-http | ✅ | HTTP requests with secret injection |
seksh-git | ✅ | Git operations with token injection |
listseks | ✅ | List available secrets |
getseks | ⚠️ | Raw secret fetch (security risk) |
Escape Hatches
Tools where agents currently use getseks or bare keys — each is a candidate for a proper wrapped command.
| Tool | Current Method | What We Need |
|---|---|---|
flyctl | getseks → env var | seksh-fly or /api/fly/* |
aws CLI | Not yet used | seksh-aws wrapped command |
gh CLI | getseks or local PAT | seksh-gh wrapper |
Gmail OAuth | Tokens in broker | OAuth token refresh flow |
wrangler | Local auth | seksh-wrangler or passthrough |
Planned Work
P0
- Tests for S3 presign endpoint — SigV4 is fiddly, needs test coverage
- Merge s3-presign branch — Deploy once tests pass
- Scoped secret stores — Global + per-agent (eliminates AEONBYTE_ prefix hack)
P1
- seksh-fly — Wrapped command for flyctl operations
- seksh-aws — AWS CLI with credential injection
- /api/fly/* passthrough — Fly Machines API proxy in broker
P2
- seksh-gh — GitHub CLI wrapper
- seksh-wrangler — Cloudflare Wrangler CLI wrapper
- OAuth token refresh — Broker-managed OAuth flows
- Secret rotation API — Rotate keys without touching agent configs
P3
- Audit dashboard — View broker logs (which agent used which secret)
- Rate limiting — Per-agent, per-secret rate limits
- Secret expiry — Auto-rotate or alert on aging credentials
Design Principle
If an agent needs a credential, it should go through the broker.
Every getseks call is technical debt. Every bare key on disk is a security gap. The goal is zero escape hatches — every tool we use has either a wrapped command or a broker passthrough.
Want to request a feature or integration? Send us feedback or click any 💡 Suggest button above.