Forget the vendor comparisons for a minute. The thing AgentValet actually competes with, in almost every real deployment, is a .env file with your Slack token, your GitHub PAT, and your Stripe secret key in it, read by an agent that can act on all three. This page takes that default seriously, including the cases where it is honestly fine.
It costs nothing. It works offline. It adds zero latency and zero moving parts, every SDK reads it natively, and you can have an agent doing useful work three minutes after you had the idea. For a solo experiment on your own machine, touching accounts only you own, with keys you would be rotating anyway, it is a perfectly reasonable choice, and we would rather say that plainly than pretend every script needs governance.
The problem is what changes when the experiment starts mattering. The agent gets more capable models and longer leashes. A second teammate copies the file. The workflow touches a customer's data, or production, or money. Nothing about the .env file changed, but every property it never had (identity, scope, approval, audit, revocation) is now a property you need. And the failure mode is quiet: a key does not warn you when it is copied, and an agent does not ask before doing everything its key allows.
| AgentValet | Raw keys in .env | |
|---|---|---|
| Who is calling? | An RS256 keypair per agent. Every call is attributable to one named agent, cryptographically. | Unknowable. A key proves nothing about who is holding it: your agent, a teammate's fork, or an attacker. |
| What can it do? | Deny-by-default scopes. The agent can call exactly what you granted and nothing else. | Everything the key allows. Most platform keys are account-wide, so the answer is usually: far more than you intended. |
| Risky actions | Pause at the broker for human approval, out-of-band, before they run. | Run. You find out afterwards, if you find out. |
| What happened? | An append-only audit row per call: agent, platform, action, outcome, and the policy that decided it. | Whatever the platform's own logs happen to show, spread across every platform, attributed to one shared key. |
| Leak blast radius | The credential is never on the agent's machine, in its config, or in its context window, so the usual leaks have nothing to find. | The whole account, for every key in the file. .env files end up in commits, containers, logs, and prompts. Ask anyone who has run a secret scanner. |
| Pulling the plug | Revoke the agent; the next call fails closed. Nothing to rotate. | Rotate every key it held, on every platform, and hope nothing cached a copy. |
| Cost and setup | Free tier, one command: npx @agentvalet/register. The broker adds one hop to each call. | Free, instant, zero added latency. This row is why it is the default. |
A reasonable rule: raw keys are for agents whose worst possible action you would shrug at. The moment an agent can email a customer, push to a repo someone else depends on, move money, or delete something you cannot restore, the worst action is no longer shruggable, and the question shifts from convenience to containment. That shift is the entire product. You do not need to rebuild the agent, change models, or adopt a framework; the agent keeps doing what it does, it just stops holding the keys while it does it.
If you want to gauge where your own setup sits, the Agent Exposure Scorecard maps it against the OWASP Top 10 for Agentic Applications in about two minutes, free, no email.
Register the agent you already run, move one key into the vault, and watch the same workflow go through with an audit trail behind it. If it doesn't feel safer within the hour, go back to the .env file; it will still be there.