Your real payment details stay with us. Your agent gets mock tokens that work at checkout. Credit cards never enter the agent context, logs, or memory.
Agent Vault holds the secrets your agent has to use but should never see. Your agent works with mock tokens, and our proxy swaps them for the real values inside a session it can't see. Cards and logins are live today, and both work exactly that way.
Give your agent a card it can't leak.
Give your agent a login it can't leak.
An agent browses a page. The page contains injected instructions. The agent dumps its context to an attacker-controlled endpoint. If your card number or your password was in that context, it's gone. Agent Vault exists to keep those secrets — cards and passwords alike — out of the agent in the first place.
If the agent is compromised, the attacker gets mock tokens. They only work through our proxy, and a proxy session times out after 15 minutes idle. They cannot make a purchase or sign in anywhere else, and you can revoke a card or login at any time.
The same flow covers cards and logins. If your agent uses Playwright, it works with Agent Vault. The rest is config in the dashboard.
Cards go in the Cards vault, logins in the Logins vault. Card numbers are tokenized to Basis Theory (a PCI-DSS Level 1 vault), so we hold only a token, never the number; logins sit encrypted. Nothing leaves until a proxy session needs it.
// dashboard Card added brand: Visa last4: 4242 exp: 09/28 Login saved site: github.com
Give a shopping agent a card with spending caps and a kill switch; give a research agent just the logins it needs. API keys are issued separately per agent.
POST /v1/virtual_cards
{
"name": "Shopping Agent",
"card_id": "card_1",
"weekly_limit": 200,
"per_txn_cap": 75
}Card fields and login fields both become tokens that look real but carry no value. A compromised agent can leak them all day.
await page.fill('#cc', 'av_card_1_number_u7x2k'); await page.fill('#name', 'av_id_first_name_u7x2k'); await page.fill('#user', 'av_login_github_username_u7x2k'); await page.fill('#pass', 'av_login_github_password_u7x2k');
A card number is revealed and typed inside the enclave; the proxy only ever forwards an opaque token. Login passwords are substituted in the proxy's own isolated session. Either way the agent cannot observe it, and the merchant or the site sees a normal request.
// inside the enclave: the proxy only ever held a token const pan = await vault.detokenize(cardToken); await page.fill('#cc', pan); // merchant sees: 4242 4242 4242 4242
The same three controls cover everything in the vault. Whether it is a card number or a password, the agent is isolated from real values, from other sessions, and, for cards, from its own spending ceiling.
Mock tokens in the agent's context, real numbers in ours. Substitution happens inside a proxy the agent cannot observe or script.
Agent cards have daily, weekly, monthly, and per-transaction caps. Optional merchant allowlists. Auto-pause on any limit exceeded.
Each agent session runs in its own browser context. Cookies, storage, and cache do not cross between sessions. Tokens are single-use and expire in 15 minutes.
Any workflow that ends in a checkout form or a sign-in form works. You decide which agent gets which card and which logins, and how much it can spend.
Three tiers: begin on Free, then step up to Plus or Pro as your agents do more. Upgrade anytime from your dashboard. Compare what each tier includes below.
| Feature | Free | Plus | Pro |
|---|---|---|---|
| Payments per month | 2 | 10 | 30 |
| Agent cards | 1 | 5 | Unlimited |
| Daily spend limits | — | Yes | Yes |
| Merchant allowlists | — | — | Yes |
| Webhook notifications | — | Yes | Yes |
| Email support | — | Yes | Yes |
| Priority support | — | — | Yes |
One drop-in import covers the whole vault: the same swap fills card fields at checkout and credential fields at sign-in. Keep the rest of your agent code.
import { chromium } from 'playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', CARD_NUMBER); await page.fill('#name', CARDHOLDER); await page.click('#pay');
import { chromium } from '@agentvault/playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', 'av_card_1_number_u7x2k'); await page.fill('#name', 'av_id_first_name_u7x2k'); await page.click('#pay');
On the long tail of stores, agents still fail at the boring parts: carts that silently no-op, payment iframes, wallet-button traps. The Checkout Recipe Registry is a community catalog of per-platform and per-merchant checkout recipes: machine-readable JSON with a schema, a validator, and an autonomy benchmark. Any Playwright agent can read it, with or without Agent Vault.
{
"id": "brushespack.com",
"kind": "merchant",
"hosts": ["brushespack.com"],
"platform": "woocommerce",
"status": "verified",
"lastVerifiedAt": "2026-06-22",
"evidence": "Order #681199, $2.00, merchant email receipt",
"cardSurface": "stripe-payment-element",
"cvvTarget": "payment-frame:input[name=cvc]",
"gotchas": [
"Set #billing_country FIRST — it AJAX-refreshes.",
"Below the Stripe minimum, no card frame mounts."
]
}// Prefer the Playwright drop-in: it strips the query, the // fragment, and any hosted-checkout token before lookup. Pass // the URL you navigated to — SdkPage has no url() getter. import { recipesForUrl } from '@agentvault/playwright'; const { merchant, platform } = await recipesForUrl(productUrl); // Or plain HTTP — public, unauthenticated, no account needed. // Send only scheme://host/path, never a session token: // GET /v1/recipes?url=https%3A%2F%2Fbrushespack.com%2Fproduct
Logins applies the card model to credentials. Save a username and password once, and your agent signs in with mock tokens. Your real credentials never enter the agent's context, so a prompt injection can't leak them.
The proxy swaps each token for the real value inside an isolated session, at the moment of submit. Add your logins from the Logins tab in the dashboard.
If something is missing, write to us. We answer honestly, including about what we don't have yet.