Keep secrets out of agents

If an agent can run commands on a machine that holds a key, it can read the key and leak it. On Leverage, the key never enters the agent's machine. Connected apps sign in once in Settings → Integrations and agents get only a short-lived session token. Other API keys go in Settings → Variables and secrets as "Added to requests": the machine holds a placeholder, and Leverage adds the real header on HTTPS requests to the hosts you choose.

Claude Code deny rules such as Read(./.env) stop its file tools, but not a shell command.

Get started

If leverage whoami --json exits 0, the user is set up: go to the first task. Otherwise follow the leverage-cloud-agents skill to install the CLI, sign up and onboard, with utm_campaign=agent-secrets in its signup link. Not installed? Run npx skills add leverage-computer/skills --skill leverage-cloud-agents.