Ages

What Inspired Us

AI doesn’t just live in the cloud anymore. Now it’s sitting right next to us—on our laptops, phones, even those tiny Mac Minis. Tools like OpenClaw let AI run directly on your own device. That sounds exciting and powerful, but let's be real—it’s kind of a security nightmare. We call it The Lethal Trifecta:

• You’ve got secrets like API keys sitting unencrypted right next to the AI, often in plain old text files.
• One credential basically gives the AI “God Mode”—anytime access to outside services.
• There’s nobody watching the store: the agents make big decisions and run commands without a human ever seeing or approving. It hit us fast: real enterprise security means you can’t just hand over your secrets to smart code and hope for the best. That’s why we built Aegis-MCP. It's a zero-trust middleware that keeps API keys out of the AI’s memory and always calls for a real-time biometric check (like a quick FaceID scan) before anything important happens. Our formula’s simple: ### How We Built It Aegis-MCP works like a shield between your OpenClaw agent and the outside world. To pull this off, we pieced together some heavy Auth0 tech:
• With our Python SDK (@with_async_authorization), you can just wrap any risky action—like running payments through Stripe or deleting a repo. Whenever the AI tries something high-stakes, Aegis freezes the action right there.
• These agents don’t have screens, so typical “log in with your browser” prompts don’t work. Instead, we use Auth0’s CIBA (Client-Initiated Backchannel Authentication) to ping your phone. You get a push notification and approve with FaceID or your fingerprint.
• Once you give the nod, the backend grabs a short-lived, strictly scoped access token from Auth0’s Token Vault. The AI never sees refresh tokens or raw API keys—just the disposable token for that one action.
• We noticed a problem: using things like Passwordless login and Enterprise SSO can create overlapping, fragmented identities. To fix that, we wrote a Post-Login Auth0 Action that links every fresh side identity right back to your main profile, instantly. ### Challenges We Faced We definitely hit some bumps. The biggest? Token exchange. We leaned on Auth0’s Token Vault Exchange, but found out the beta couldn’t handle those weird opaque tokens CIBA makes for biometric pushes. Instead of faking the demo or scrapping the project, we just built a fallback. If the Token Vault can’t handle a CIBA token, Aegis automatically spins up a secure Machine-to-Machine tunnel to Auth0’s Management API and fetches what it needs. Everything still hums along, and no one—not the agent, not the user—ever notices. It’s always just-in-time access, even when things go sideways. ### What We Learned What stuck with us? Securing AI isn’t about making the AI itself “smarter.” It’s about drawing better boundaries around what it can do. We dove into zero-trust, just-in-time credentials, and the messy world of live approvals. Maybe most important, we learned resilience is everything—don’t just design for smooth sailing; plan for those moments when the latest beta blows up in production. Let the agents do brilliant things, but make sure your guardrails are even smarter. ### BONUS BLOG POST: The Architecture of Agentic Consent—Why Token Vaults are the Future of MCP The Model Context Protocol (MCP) is catching on fast and finally gives AI agents a standard way to talk to external tools. But MCP inherently lacks a native, built-in identity and authorization layer. Right now, most developers are forced to hardcode static API keys directly into their local MCP servers to make things work. That is a massive security problem—if a sovereign agent gets compromised via a clever prompt injection, a file read vulnerability, or a malicious web interaction, the attacker instantly gains unmitigated, persistent access to every linked enterprise service, whether that's a Stripe billing account or a production GitHub repository. Enter Auth0 Token Vault. Plugging this advanced feature into agentic workflows completely flips the traditional threat model on its head. The Token Vault takes the immense risk of credential storage right out of the local developer’s hands and securely shifts it over to Auth0’s locked-down, enterprise-grade infrastructure. When we built Aegis-MCP, we proved that the Token Vault isn’t just a static safe deposit box—it is a highly active credential broker. When paired with Asynchronous Authorization (CIBA), the Vault gives you true Just-In-Time (JIT) Access. The local MCP server stays totally in the dark, possessing zero credentials, until a human user explicitly verifies their identity with biometrics, out-of-band and in real time. Only when they approve does the Vault dish out a brief, tightly scoped token that expires right after the job is successfully completed. That architectural approach—keeping long-lived refresh tokens entirely out of the agent’s reach and letting the Vault mint short-lived operational tokens only after explicit human sign-off—is the only secure way to scale autonomous systems safely in the enterprise. We need to shift our engineering mindset: don’t implicitly trust the AI, cryptographically verify the human.

Built With

• auth0
• ciba
• python