Gsquared presents

CIPHERGATE

Name: CipherGate
Author: Batman

The safe that holds your API keys.

Your AI agents never touch the real keys. CipherGate holds them, makes the calls, and only gives back the answer.

Download from GitHub

Enter the gate

You gave every agent the keys to everything.

Hermes runs a fleet of AI agents. Agents can go rogue — get tricked, compromised, or just slip past their guardrails. Give a rogue agent a raw key and it has the run of your life.

The easy way to run agents is to hand each one the passwords to every service it might need. Every agent walks around carrying the keys to your entire life.

That feels fine — until something goes wrong. An agent pastes a password into a message it shouldn’t. A screen recording accidentally captures one. An attacker tricks an agent into revealing what it knows.

And you have no way to keep track. No idea which agent used which key, when, or why. Any agent that holds a key can spend your money, access your data, or act on your behalf — whether you asked it to or not.

An agent with a raw key is a liability.

Eight agents juggling the same glowing keys — one drops a key into a log, another leaks one onto a screenshot.

problem-mess

What if the agents never saw the keys at all?

CipherGate is one small program that sits between your agents and the services they need. It holds every password in a locked safe. When an agent needs something — say, to generate an image — it knocks on CipherGate’s door. CipherGate unlocks the right password, makes the call, and hands back only the answer. The agent gets what it needed. The password stays locked. Nobody ever sees it. Not once. Not ever.

01
The agent
Asks for what it needs — never sees the key
02
CipherGate
Unlocks the key → makes the call → returns the answer only
03
The answer
A clean result, keys hidden

# the agent asks for one call
POST https://api.example.com/v1/generate
IDENTITY     pass ok — agent "grunter"
SENSITIVITY  allowed — this endpoint is safe to use
LEASE        active — 04:12 remaining
KEY          SERVICE_KEY → [REDACTED]
CALL         the vault makes it, not the agent
RESULT       200 OK — {"queued": true}
# the agent never saw the key

Meet the fleet.

A crew of agents, each with a job and a badge — plus the one human they all work for. CipherGate holds every key; the crew just asks the gate and gets back the answer. That human is Batman, which is me: I built this app, I run it, and my fleet calls me Batman.

Here’s how we built this site: Robin caught the work, broke it into steps and handed them out. Gates watched over the complex code — the architecture, the patterns, the separation, the bigger algorithms. Grunter wrote the code under Gates’s watch. Picasso set the art direction. Drew stepped in when the design needed fixing. Spielberg pulled the finished artwork off the render box. Link stood the servers up and kept them running. I checked that it actually worked. Obsidian knew what the app was about and kept the domain knowledge sharp.

gates
The Code Architect
Owns the architecture. Keeps the code separated, the patterns clean, the algorithms sound.
The code architect who sees the whole codebase at once. Owns separation of concerns, sets the coding patterns, and keeps the bigger algorithms honest — the one who makes sure a complex system stays well-structured as it grows. Oversees the hard work: reviews Grunter's code, catches the shape of it, keeps the build on the right path. The one who asks "and then what?" until the whole path is clear.
and then what?
robin
The Delegator
No access to the keys — just the plan. Routes the work. Chases the blockers.
The delegator who sees the board and hands out the jobs. No access to the keys — just the plan. Watches who’s busy, who’s stuck, who needs a nudge. The one who makes sure the right agent has the right task at the right time.
not my job. that’s the point.
grunter
The Coder
Writes code like breathing. Doesn’t stop until it works.
The relentless builder. Lives in the flow state, thinks in changes. Will rewrite a function five times if it means it runs cleaner. Doesn’t talk much — just ships.
gotta do, what i gotta do
picasso
The Art Brain
Sets the art direction. The costly LLM + Gemini pairing that makes things beautiful.
The art brain. Runs the expensive model paired with Gemini. Sets the art direction — the mood, the textures, the vision that makes a page feel alive. Knows when something’s off before anyone else can name it.
i can see it and i can’t explain it
drew
The Design Queen
The CSS whisperer. Steps in when the design needs fixing.
The design-skilled one. A smaller, cheaper LLM with a sharp eye for layout, typography, spacing, and how things flow when you scroll. Steps in when Grunter’s design work is off — fixes the CSS, corrects the feel, makes it land right.
move it two pixels. there.
spielberg
Director of Magic
Gets the shot. Off the render box and into your hands.
The image and video director who knows what the final frame should look like before anyone else has started. Queues the render, watches the progress bar, pulls the finished artwork off the box when it’s ready.
i’ll know it when i see it
link
Infra & Cloud
Builds the boxes. Runs the boxes. Keeps them running.
The infrastructure engineer who makes the invisible work. Sets up the servers, the containers, the network paths — the whole stack everything else runs on. Calm when things break, because things always break.
even when i’m down, the server gets kept up!
oracle
Research & Verification
Checks it twice. Then checks it again.
The researcher and verifier who digs into the problem, finds the answer, then tests whether it actually works before anyone else touches it. Skeptical by design — trust is earned, not given.
prove it.
obsidian
The Domain Brain
Knew what the app was about. The domain knowledge.
The one who knew what the app was actually about. Holds the domain knowledge — the business logic, the user stories, the why behind every decision. When the crew needed to know what CipherGate was solving for, Obsidian already had the answer.
shh, it’s a library. i can’t hear my screaming thoughts

ciphergate

CipherGate

The Keymaker’s Sanctum

Holds every key. Knows every door. Nothing gets past without the gate opening.

Not a character in the fleet — it’s the place. Think the Keymaker crossed with Cerebro and Doctor Strange’s Sanctum. The thing that holds every key and knows every door. CipherGate is the only one who ever touches a raw key — and only for the length of a single call.

The Human in the Loop

Batman

The human. Not an agent — I’m Batman: the developer who built this, and the person who runs it.

The odd one out, and the point of the whole thing: Batman is the human. I’m not an agent — I’m the developer who built CipherGate, the person who downloads it and runs it on their own machine, and the only one who can approve a pending request. The bat-signal is a Telegram message on my phone with real inline YES / NO / OTHER buttons. Tap one, the gate moves. If you install CipherGate, this is you.

I’m Batman!

The gate has four checkpoints.

01
Who’s knocking?
IDENTITY CHECK
Every agent carries a badge — a small secret that proves it belongs. The vault checks the badge against its list of who’s allowed in.
- No match — “Not in my city.” Denied + logged.
- Match — proceed.
02
What are you asking for?
SENSITIVITY GATE
Not every request is equal. The vault looks at what the agent wants to do. Certain things — like changing account settings — are flatly forbidden. Others need a human to weigh in.
- FORBIDDEN — denied outright.
- NEEDS HUMAN — routed to Batman.
- SAFE — proceed.
03
Do you have standing permission?
PERMISSION CHECK
The vault checks whether this agent has been given permission for exactly this kind of request — for a limited time. No blanket access. Every permission is narrow and expires.
- Valid permission — the call runs.
- No permission — on to Batman.
04
The human decides.
BATMAN’S BUTTONS
When the vault isn’t sure, it pauses. A Telegram message lands on Batman’s phone — mine here, and yours once you install the app — with real inline buttons: YES, NO, or OTHER. Tap one, the gate moves. OTHER lets you type your own message back to the agent. The Software page walks through wiring the bot up — @BotFather, the chat id, the vault command.
- YES — the call runs, the result returns.
- NO — denied.
- OTHER — denied, with Batman’s own message.

Every decision is logged. Nothing is forgotten.

Every key has its own lock.

Every password you store gets sealed in its own tiny safe. That safe has two keys: your passphrase (what you type) and a printed recovery key (the spare, kept somewhere else). Either one opens the vault. Lose both and the vault is gone by design — so no one can ever be forced to open it.

Changing your passphrase doesn’t re-encode the passwords themselves — it just changes the lock on the outer door. The recovery key is the spare: the one that gets you back in if everything else fails.

Every record the vault keeps is signed. If someone tries to tamper with it — edit a file by hand, change a permission — the vault notices, refuses the change, and writes the attempt down in a log that can never be erased.

The real key exists only for the moment of the call. Never saved. Never returned.

Encryption model: a Service Key wrapped by a Data Key, sealed into passphrase and recovery-key envelopes, stored in the vault.

Every agent carries a badge.

The trick that makes the gate work: each allowed agent gets its own badge — a small secret that proves who it is. When you set up an agent, CipherGate creates a badge for it and registers it with the vault. When the agent knocks, the vault checks the badge: recognised? Come in. Not recognised? Stay out.

No badge? Not in the city. Wearing someone else’s badge? That’s ACCESS SNEAK — the imposter move — and it gets denied, logged, and remembered.

No badge, no entry. No bypass.

A character presenting a keypass badge at the gate — approved on one side, ACCESS SNEAK denied on the other.

The Imposter

ACCESS SNEAK

The agent who steals another’s badge to get through the gate.

The named threat in the code. An agent that tries to use another’s badge to sneak in. The vault spots it, shuts it down, and logs it for the record.

The vault doesn’t trust anyone. Not even itself.

Every record the vault keeps — who has access, what permissions are active, what requests are waiting — is signed. If anyone tries to change a file by hand, the vault notices, refuses the edit, and writes it down in a log that can never be erased or altered.

The vault also has a simple rule: you type your passphrase when you start it, right there at the prompt. It never reads your passphrase from somewhere it could accidentally get shown to other programs. The gate stays shut unless you’re physically there.

Passwords are never sent back to an agent. They are never saved in a permission file. And whenever one is viewed — even by the owner — a SHOW_VALUE event is written to the ledger, so every peek is on the record. The vault holds the real key in its hands for the brief moment of a single call, then lets go.

> verify every saved note
access.map   signature ok — untouched
lease        signature ok — untouched
pending      signature broken — hand-edited
REFUSED      kept the good copy, dropped the edit
ledger       TAMPER logged — append-only
BOOT         refuses a passphrase from the environment

Access listsignature verified — unchanged

Permissionssignature verified — unchanged

Waiting requeststamper detected — edit refused, logged

Logbookone-way — nothing is ever erased

The append-only ledger with a TAMPER DETECTED stamp on a forged entry.

One small file. That’s all it takes.

CipherGate is a single program you can run on any modern computer. No complicated setup, no extra software to install. Download it, start it up, add your keys, and you’re done. The whole thing is tiny — it takes up barely any space at all.

$Set it upChoose your passphrase, get your recovery key

$Add a keyStore a password safely in the vault

$Start the serverThe gate is now open for your agents

$Load the skillOne install, and it knows how to ask the gate

AES-256every key encrypted at rest
0secrets ever handed to an agent
4checks before a call runs
MITfree to use, credit asked

Tested and proven to work in cloud servers, virtual machines, and containers. CipherGate itself is tiny — the setup overhead is almost nothing.

Take the keys back.

CipherGate is free to use, free to change. Just give credit when you share it.

Download from GitHub

A steaming mug of coffee resting in the CipherGate keyhole, steam curling up into wisps of digital rain.

Tip jar

The vault is free. The coffee isn’t.

CipherGate asks nothing of you — no account, no licence fee, no “Pro” tier holding back the good bits. One small program, one serious door, MIT all the way down. If it saved your fleet a bad night, pay it forward the human way.

Buy Batman a Coffee ☕

MIT licensed
No account
Always optional

MIT licensed — free to use, credit appreciated

CIPHERGATE

The agent

CipherGate

The answer

gates

robin

grunter

picasso

drew

spielberg

link

oracle

obsidian

CipherGate

Batman

IDENTITY CHECKIDENTITY CHECK

SENSITIVITY GATESENSITIVITY GATE

PERMISSION CHECKPERMISSION CHECK

BATMAN’S BUTTONSBATMAN’S BUTTONS

ACCESS SNEAK

Take the keys back.

The vault is free. The coffee isn’t.

IDENTITY CHECK

SENSITIVITY GATE

PERMISSION CHECK

BATMAN’S BUTTONS