tools-registry — share your team's keys and skills, without handing out a key

try it live · no signup

Try it live

1 keys stay in the vault→ 2 point at an API or a skill→ 3 call it with just a token

🔒 vault

treg holds these · referenced by name · never downloaded to a machine

🔑

Prefilled with the real Stripe API and your vault's STRIPE_KEY — just hit Add (or type any URL).

how it works

The key stays home.
The tool travels.

Four moments, one journey — scroll through what happens when a teammate's agent uses a tool it doesn't own.

01 · scan & upload

Alice's laptop

Scan your skills and keys. Upload them safely.

treg scan reads your project — every skill and every .env key, listed before anything moves. Then treg upload registers and encrypts the lot. The plaintext never leaves the scan.

02 · call

Bob's laptop

Now the whole team can call it.

Alice imported it — Bob just calls it. treg call from any machine, any agent: the key is injected automatically. Nothing to configure, no key on Bob's laptop, ever.

03 · inject

▚the treg server — nobody's laptop

Here's the hop where the key appears.

What leaves Bob's machine carries only his personal treg token. Inside the proxy, that token is swapped for the org credential — and api.stripe.com receives a normal, fully-authed request.

04 · audit

the whole team

Every call lands in the log.

Who called, which tool, when, status and latency — attributed to the person, not a shared key. Rotation is one edit; usage caps are per-user.

alice@laptop — treg cli

Alice

$ treg call stripe /v1/refunds --method POST · x-ray

what leaves bob's machine

POST /call/stripe/v1/refunds HTTP/1.1
Host: treg.superdesign.dev
Authorization: Bearer treg_tok_bob_7f3a…

▼ proxy swaps identity → org credential ▼

what api.stripe.com receives

POST /v1/refunds HTTP/1.1
Host: api.stripe.com
Authorization: Bearer treg_tok_bob_7f3a… sk_live_•••••••• ← injected

timewho → toolresult

14:32:07

bob@ → stripe

POST /v1/refunds · re_9f2…

200 · 412ms

14:31:44

tim@ → posthog

POST /api/query · 3.2k rows

200 · 96ms

14:29:03

alice@ → google-ads-report

GET /v16/customers/…/report

200 · 1.2s

14:22:51

bob@ → resend

key rotated by alice@ 14:20

401 → retried · 200

14:18:20 🤖agent:crm-loop → posthog

daily cap 82% used

200 · 104ms

plaintext never leaves the scan

why not just a password manager?

Secret managers store keys.
treg makes them callable.

A tool-vault holds more than secrets — the key, the endpoint or CLI it unlocks, and the skill that knows how to use it. For humans and agents alike.

keys in dms

1password

▚ tools-registry

What's shared

✕ pasted keys

✕ secrets only

✓ keys + endpoints/CLIs + skills

Who can use it

✕ whoever has a copy

✕ humans only

✓ humans & agents, natively

How keys are used

✕ lives in six .env files

✕ copied out in plaintext

✓ injected server-side

Rotating keys

✕ hunt every copy

✕ update + re-paste everywhere

✓ one edit, zero downtime

Audit history

✕ nobody knows

✕ vault-access log only

✓ every call logged, per person & agent

where keys go wrong

Three ways a key leaks.
treg closes all three.

The same secret, needed in more and more places — and every place is a copy that can leak.

Key sprawl

The same key pasted into every project, .env, and machine. One leak exposes them all.

treg → one vault. The key is injected at call time and lives nowhere else.

Team access

Give a teammate access and they hold your key — forever, everywhere they go.

treg → they get a token, not the key. Revoke it and they're out.

Agent skills

A skill needs credentials to run. Sharing the skill shouldn't mean shipping the secret.

treg → the skill calls through the vault. Your agent runs it and never sees the key.

Share skills & secrets
without leaking keys

Every call lands in the log.

Try it live

The key stays home.
The tool travels.

Scan your skills and keys. Upload them safely.

Now the whole team can call it.

Here's the hop where the key appears.

Every call lands in the log.

Secret managers store keys.
treg makes them callable.

Three ways a key leaks.
treg closes all three.

Share skills & keys
Without sharing real keys

Try it live

The key stays home.The tool travels.

Scan your skills and keys. Upload them safely.

Now the whole team can call it.

Here's the hop where the key appears.

Every call lands in the log.

Secret managers store keys.treg makes them callable.

Three ways a key leaks.treg closes all three.

Share skills & keysWithout sharing real keys

The key stays home.
The tool travels.

Secret managers store keys.
treg makes them callable.

Three ways a key leaks.
treg closes all three.

Share skills & keys
Without sharing real keys