GhostKey

Demo

About

GhostKey is a Ledger-backed trust and authorization layer for autonomous AI agents. Today’s agents often operate by receiving powerful, long-lived credentials such as API keys, cloud credentials, GitHub tokens, database secrets or wallet access. Once a secret enters an agent’s environment, prompt injection, malicious tools, logs or compromised dependencies can potentially expose it. GhostKey changes the model from giving agents secrets to giving agents authority. Each agent receives an ephemeral identity and narrowly scoped capabilities defining exactly what it may access, which actions it may perform, on which resource, and for how long. The underlying credentials remain protected and are consumed internally by GhostKey rather than exposed to the agent. Ledger provides the hardware-backed root of trust. Ledger Key Ring protects service credentials while allowing authorized agent workflows to operate headlessly. For sensitive operations, GhostKey escalates from autonomous execution to explicit Ledger-backed human approval. The prototype demonstrates this architecture with two providers: GitHub and AWS S3. An agent can inspect a repository, create an issue, list/read a specific S3 bucket, and operate across providers without receiving the GitHub PAT or AWS credentials. Unauthorized actions such as repository delete or S3 delete are blocked before any provider request is sent. The result is a new security boundary for autonomous software: agents get the minimum authority they need, for the minimum amount of time, without inheriting the user’s permanent identity.

How it's made

GhostKey is built with Next.js and TypeScript around a local capability broker. Every agent receives an ephemeral Ghost Identity. A capability engine binds that identity to a provider, resource, set of allowed actions and expiration time. Every operation is authorized against these constraints before a provider is contacted. Ledger Key Ring (wallet-cli ring) forms the secret-protection layer. Long-lived provider credentials are encrypted using Ledger-backed keys. When an authorized operation needs a credential, GhostKey decrypts and consumes it internally inside the provider adapter. The raw credential is never returned through the web interface, MCP tools or agent-facing APIs. Provider adapters separate authorization from credentials. GitHub demonstrates developer-platform authority with repository read and issue creation. AWS S3 demonstrates cloud-resource authority with list/read access to a scoped demo bucket. Destructive actions like github.repo.delete and aws.s3.delete are intentionally rejected with ACTION_NOT_ALLOWED before any provider call occurs. GhostKey also exposes an MCP interface so AI clients can discover and use capabilities without gaining access to the credentials behind them. For high-risk authority escalation, GhostKey uses Ledger hardware approval through the Ethereum app/device signing flow. A browser click alone cannot mint elevated authority; the user must physically confirm on the Ledger device. The resulting elevated capability is short-lived and expires automatically. One interesting design choice is separating secret access from authority: possession of a capability does not reveal the credential that makes the action possible. Capabilities are scoped, expiring and resource-bound, creating an authority-decay model instead of handing autonomous agents long-lived credentials.