The Trust Layer that secures AI agents for enterprises through identity, authorization, and governance. Every AI agent gets a cryptographic identity, fine-grained permissions, and audited access to external tools — without exposing a single API key.
Quickstart · API Reference · SDK Reference · Examples · Community
AI agents today operate with shared static API keys, no identity, all-or-nothing permissions, and zero audit trail. One compromised agent means full system compromise.
# Status quo: every agent gets the master key
os.environ["NOTION_API_KEY"] = "secret_abc..." # shared across all agents
os.environ["SLACK_BOT_TOKEN"] = "xoxb-..." # no per-agent scoping
agent.call_tool("notion.delete_page", ...) # who authorized this?DeepSecure sits between your agents and external services as a Virtual MCP Server. Agents authenticate with Ed25519 cryptographic identities, receive only the permissions they've been delegated, and never see raw API keys. Every action is logged with full human attribution.
import deepsecure
client = deepsecure.Client()
# Each agent gets a unique Ed25519 identity stored in the OS keyring
agent = client.agent("research-assistant", auto_create=True)
# Authenticate via challenge-response — no passwords, no API keys
client.authenticate(agent.id)
# Agent calls tools through the MCP Gateway
# The gateway enforces permissions, injects credentials, and logs everything
response = client.gateway.call_tool(
"notion.search_pages",
arguments={"query": "Q3 planning"}
)| Capability | What it does |
|---|---|
| Cryptographic Agent Identity | Every agent gets an Ed25519 keypair. Authentication via challenge-response — no shared secrets. |
| Virtual MCP Server | One MCP endpoint exposing 34 tools across 6 services. Agents see only the tools they're allowed to use. |
| Fine-Grained Delegation | Users delegate specific permissions to agents. Agents can sub-delegate to other agents. Permissions only shrink, never grow. |
| Task Tokens | Short-lived, task-scoped JWTs that further narrow an agent's permissions to exactly what one task requires. |
| Prompt Injection Detection | Gateway scans tool arguments for injection patterns before forwarding to external services. |
| PII Result Filtering | Sensitive data in tool responses is detected and redacted before reaching the agent. |
| Fail-Closed Security | If the Control Plane is unreachable, the Gateway denies all requests. No silent degradation. |
| Full Audit Trail | Every authentication, delegation, tool call, and policy decision is logged with human attribution. |
| SSO Integration | Authenticate users via Keycloak or Google. Map IdP groups to DeepSecure policies automatically. |
The Gateway acts as a unified MCP endpoint for these backends:
| Service | Tools | Examples |
|---|---|---|
| Notion | 8 | search_pages, create_page, query_database, read_page, ... |
| Slack | 7 | send_message, list_channels, search_messages, list_users, ... |
| GitHub | 5 | list_repos, get_repo, list_issues, get_issue, list_pull_requests |
| Google Drive | 4 | search_files, read_file, list_files, get_file_metadata |
| Google Calendar | 4 | list_events, search_events, list_calendars, read_event |
| Gmail | 4 | list_messages, read_message, search_messages, list_labels |
Each tool maps to a permission URN (e.g., notion:pages:read). Agents can only
call tools they've been explicitly delegated.
User Control Plane Gateway External APIs
│ │ │ │
│ 1. Login (SSO/creds) │ │ │
│────────────────────────>│ │ │
│ <── User JWT ──────────│ │ │
│ │ │ │
│ 2. Delegate perms │ │ │
│ to agent │ │ │
│────────────────────────>│ │ │
│ │ │ │
│ Agent │ 3. Challenge-response │ │
│ │ auth (Ed25519) │ │
│ │<─────────────────────────│ │
│ │──── Agent JWT ──────────>│ │
│ │ │ │
│ │ 4. MCP tools/call │ │
│ │ (with Agent JWT) │ │
│ │ ┌────────────────────│ │
│ │ │ • Validate JWT │ │
│ │ │ • Check permissions│ │
│ │ │ • Scan for inject. │ │
│ │ │ • Inject secret │ │
│ │ └────────────────────│── API call ──────────>│
│ │ │<── response ──────────│
│ │ │── filter PII ────> │
│ │ 5. Audit logged │ │
│ │<─────────────────────────│ │
DeepSecure implements a dual-service architecture separating policy decisions from policy enforcement:
Control Plane (deeptrail-control) — the brain. Manages agent identities,
issues JWTs, stores policies, handles delegation, runs the audit log, and
manages the encrypted credential vault.
Gateway (deeptrail-gateway) — the enforcer. Exposes a single MCP endpoint,
validates every request against the agent's JWT claims, injects credentials at
the last mile, and forwards calls to external service APIs.
graph TB
A[AI Agent] -->|MCP JSON-RPC| C[Gateway :8002]
C -->|Validate JWT & Permissions| D[Control Plane :8000]
C -->|Inject Credentials| E[Notion API]
C --> F[Slack API]
C --> G[Gmail API]
C --> H[Google APIs]
D --> I[(PostgreSQL)]
D --> J[Policy Engine]
D --> K[Audit Log]
D --> L[Credential Vault]
C --> M[(Redis — split-key store)]
style A fill:#e1f5fe
style C fill:#f3e5f5
style D fill:#e8f5e8
- Docker and Docker Compose
- Python 3.9+ and pip
git clone https://github.com/DeepTrail/deepsecure.git
cd deepsecure
docker compose up -dThis starts the Control Plane (:8000), Gateway (:8002), PostgreSQL,
Redis, and Keycloak.
pip install deepsecureThe Sarah's Journey demo walks through the full flow — user login, agent creation, delegation, OAuth service connection, MCP tool calls, security enforcement, and audit trail:
# Full automated demo with all steps
./scripts/demo_sarah_journey.shOr use the interactive Python demo:
python demos/demo_sarah_journey_interactive.pyFor a step-by-step HTTP walkthrough with curl commands, see the Quickstart Guide.
import deepsecure
# Connect to your DeepSecure instance
client = deepsecure.Client(
deeptrail_control_url="http://localhost:8000",
deeptrail_gateway_url="http://localhost:8002",
)
# Create an agent with a cryptographic identity
agent = client.agent("my-agent", auto_create=True)
# Authenticate (Ed25519 challenge-response)
client.authenticate(agent.id)
# Delegate permissions from user to agent
client.delegate(
agent_id=agent.id,
permissions=["notion:pages:read", "slack:messages:write"],
ttl_seconds=3600,
)
# Call tools through the MCP Gateway
result = client.gateway.call_tool(
"slack.send_message",
arguments={"channel": "#updates", "text": "Report ready."}
)
# Check the audit trail
events = client.get_audit_trail(agent_id=agent.id)DeepSecure integrates with LangChain, CrewAI, OpenAI, and Anthropic:
# LangChain
from deepsecure.integrations.langchain import SecureLangChainTools
tools = SecureLangChainTools(client, agent_id=agent.id)
# CrewAI
from deepsecure.integrations.crewai import SecureCrewAITools
tools = SecureCrewAITools(client, agent_id=agent.id)
# OpenAI (gateway-proxied)
response = client.openai.chat_completion(
model="gpt-4",
messages=[{"role": "user", "content": "Summarize the Q3 report"}],
)| # | Example | Description | Framework |
|---|---|---|---|
| 01 | Create Agent & Issue Credential | Agent identity and credential lifecycle | Core SDK |
| 02 | SDK Secret Fetch | Retrieve secrets via the vault | Core SDK |
| 03 | CrewAI Secure Tools | Multi-agent crew with fine-grained control | CrewAI |
| 04 | CrewAI Without Fine-Grain | CrewAI with simplified permissions | CrewAI |
| 05 | LangChain Secure Tools | Secure LangChain agent tools | LangChain |
| 06 | LangChain Without Fine-Grain | LangChain with simplified permissions | LangChain |
| 07 | Multi-Agent Communication | Agent-to-agent delegation patterns | Core SDK |
| 08 | Gateway Secret Injection | Automatic credential injection at the gateway | Core SDK |
| 09 | LangChain Delegation | Delegation workflows in LangChain | LangChain |
| 10 | CrewAI Delegation | Delegation workflows in CrewAI | CrewAI |
| 11 | Advanced Delegation | Complex multi-hop delegation chains | Core SDK |
| 12 | Platform Bootstrap | Kubernetes/AWS/Azure agent bootstrapping | Infrastructure |
| 13 | OpenAI Quickstart | Gateway-proxied OpenAI calls | OpenAI |
| 14 | OpenAI Policy Enforcement | Policy enforcement on model access | OpenAI |
| 15 | LangChain + Composio + Notion | End-to-end Notion integration via LangChain | LangChain |
| Resource | Description |
|---|---|
| Quickstart Guide | 15-minute walkthrough with curl commands |
| HTTP API Reference | All Control Plane and Gateway endpoints |
| Python SDK Reference | Client API, integrations, and CLI |
| CLI Reference | All CLI commands and options |
| Product Features | Comprehensive feature list |
| Product Use Cases | Workflows by persona (IT Admin, Engineer, Security) |
| Developer Workflow | Development setup and contribution workflow |
| Sarah's Journey Demo | Step-by-step UI implementation walkthrough |
DeepSecure is open source and contributions are welcome.
- Report bugs or request features: GitHub Issues
- Ask questions or share ideas: GitHub Discussions
- Submit code: See CONTRIBUTING.md for setup and guidelines
- GitHub Discussions — questions, use cases, and community conversations
- GitHub Issues — bug reports and actionable feature requests
- Discord — Join us
Apache 2.0 — see LICENSE for details.
Star us on GitHub if DeepSecure helps secure your AI agents.
Quickstart · API Reference · Discord
Built for the AI agent developer community by DeepTrail