Hacker News
Agent IAP is an MIT-licensed Rust proxy that swaps agent tokens for 1Password credentials behind allow/deny/ask ACLs
Viktor Petersson's Agent IAP gives each agent a token that is worthless outside the proxy. The proxy checks an ACL (allow, deny or ask with time-limited grants), strips the token, attaches the real credential pulled from 1Password, and logs every decision to a hash-chained audit log. It ships about 50 service profiles (GitHub, Stripe, Cloudflare, Sentry and others), supports MCP servers and per-process workload identity, and installs through Homebrew. It is a concrete answer to the credential-authority problem behind this week's agent-breach stories.
↳ Follow the thread