Skip to main content
With a local proxy, everything happens on the computer you are already working on. The proxy starts alongside your agent, hands it placeholder credentials, swaps in the real ones as its requests leave, and stops when the agent exits. There is nothing to deploy and no machine identity to create: the proxy brokers as your logged-in user, against secrets you can already read. Because the proxy and the agent share a machine, an OS sandbox is what keeps them apart. The agent cannot read your keyring or your credential files, and its only route to the network is the proxy.
By the end of this page an agent on your machine makes authenticated GitHub calls with a token it never sees.

​
Before you begin

  • Set up credentials finished, so you have a GITHUB_PAT secret and a github proxied service in /coding-agent.
  • The Infisical CLI installed.
  • macOS, or Linux with bubblewrap installed.
  • Optional: GitHub’s gh CLI, used for the check at the end. A curl fallback is provided, so this is not required.
The sandbox comes from the operating system, so what you install depends on which one you are on:
Nothing to install. The sandbox is part of macOS.

​
1. Log in

run brokers as you, so this is the only credential involved.

​
2. Launch your agent

Everything after -- is your agent’s own command. Run it from the directory you want the agent to work in:
This one command starts the proxy and your agent together, and shuts the proxy down when the agent exits. The agent behaves exactly as if you had launched it directly. In its environment it finds GITHUB_TOKEN, set to the fake ghp_… placeholder, and uses it like a normal token. Calls to api.github.com get the real token swapped in as they pass through; everything else goes out untouched. Meanwhile the agent is sandboxed: it cannot read your keyring, your ~/.aws or ~/.ssh, or your Infisical token.
In a directory with an .infisical.json (from infisical init) you can drop --projectId. --env and --path fall back to environment variables too, so in a configured shell this is just agent-proxy run -- claude.
On macOS the first run asks for your password once. It adds the proxy’s local CA to your login keychain, which is what lets tools like gh accept its certificates.

​
3. Verify it works

Each check below makes the same GET /user call to api.github.com, and the client only ever sends the fake ghp_… placeholder. As the request passes through the proxy the placeholder is swapped for the real value of your GITHUB_PAT, so GitHub returns your account profile even though the real token never reached the client. That is the whole point: real authenticated work without the caller ever holding the credential.
The agent you just launched is already brokering. In its session, send:
Run gh api user and show me the output.
GitHub’s gh CLI reads GITHUB_TOKEN from the environment on its own, so the agent needs no token wiring: it runs the command and GitHub answers with your profile. Requires gh on your machine.
Getting a 401? The proxy could not apply the credential and forwarded the placeholder unchanged. Confirm you have Read Value on GITHUB_PAT, since run brokers as you, and that the host pattern matches api.github.com. Add --log-file=/tmp/broker.log and tail -f it to see the decision for each request.
For more depth, the Local Agent Proxy reference covers what the sandbox allows and denies, how certificates work, and every flag run takes.
For agents running on your infrastructure, follow the Standalone Proxy quickstart instead.