> How do you let an agent use a tool that needs credentials without giving the credentials to the agent?

    1. Register a secret and get back an opaque identifier (out-of-band, human action; can extend and add an API for listing by endpoint)
    2. Generate a JavaScript API call that includes the opaque identifier as header (for example)
    3. Send the JavaScript to a server that runs a JS interpreter
    4. Pre-process the inbound JS and replace the opaque identifier with the actual token
    5. Run the JS to invoke the API, make transforms, process the result, etc.

[0] https://github.com/CharlieDigital/runjs

This is great, we are working on something similar at 1Claw but I like your approach too. Want to trade notes sometime?

How would someone send the audit evidence to their organization's centralized log collection service(s)?