harnsy Max
Agents use your keys without seeing them.
An agent that needs GitHub or a model provider asks harnsy to make the call. harnsy adds the key on the way out and sends it only to the hosts you listed. The key never enters the agent’s session. A harnsy Max key turns it on.
github-ciapi.github.com
Authorization: Bearer …a91f
Who may use it: acme-shop › shop-backendacme-shop › shop-qa
read only · /repos/acme/ · 60/min
openai-evalapi.openai.com
Authorization: Bearer …7c2e
Who may use it: acme-shop › shop-qa
A key goes in and never comes out.
You add a key in Settings › Keys (“Add a key”) with a name and the hosts it may go to. After that the dashboard shows only its last four characters. An agent calls the service through harnsy with its own seat’s token, never with your key.
Only to the hosts you set.
Each key lists up to eight hosts. Your key is added only to calls to those hosts, never to any other, and private addresses such as localhost are refused. Calls go to https://<host>, on port 443 unless you set another; harnsy follows no redirects. You pick whether the key goes in a header or in the query, and in what form.
Who may use it, and how much.
You choose the projects and roles a key is offered to. You can limit it to some methods and some paths, make it read-only, and cap the requests per minute. This is a setting, not a wall: an agent on this machine can seat a helper on a role, so offer a key only to roles you would trust with that access.
A log of every call.
Each call an agent made with a key is logged. The dashboard lists when, who, the request (method and path) and the result, including calls that were refused. The log is kept for 90 days and holds no key.
A GitHub token you can see the reach of.
Add a GitHub token as a connection and harnsy lists the repositories it reaches and the projects they belong to. A fine-grained token can be offered to agents as a key without copying it. GitHub cannot say whether a token may change workflows (.github/workflows), so you confirm that it may not, or that agents may. If the token sees more repositories than the projects use, you confirm that the agents of these projects reach all of them. harnsy refuses a token that can read repository or organization secrets, hooks or actions permissions.
Rotate or revoke in one place.
Put a new value into a key and every agent keeps working; nothing to change in a session or a config. Revoking a key wipes harnsy’s copy at once; the row stays for the log. The key itself still works at the service until you revoke it there.
Limits, honestly
- The Keystore hides the key. It does not limit what an agent does with the access you gave it: set the methods, paths, read-only and the rate.
- A key’s hosts, port and the way it is added cannot be changed afterwards; make a new key instead.
- A key goes only to https://<host>, on port 443 unless you set another (1–65535). Redirects are not followed and no environment proxy is used. Hosts are public: no localhost, no private addresses.
- GitHub keys from a connection need a fine-grained token; a classic token is refused.
- The key stays on the machine harnsy runs on.
Your first team is one prompt away.
Installing takes one sentence to your agent. To open agents for you, harnsy drives a terminal: tmux on Linux and macOS, its own terminal host on Windows.
Install harnsy following https://harnsy.dev/llms.txt