A sandbox your coding agent can’t leak out of.

Full access, zero secrets. Spin up an isolated, reproducible pod - your agent fully authed, and not one vendor secret inside it.

Every secret stays out of the pod - especially the ones you forgot you had.

Start free Self-host it

We run it all in the cloud - broker, vault, and pods, nothing for you to operate. Or self-host the open source; the same guarantee either way.

The problem

Coding agents want your keys. Don’t give them any.

Without poddle Your agent runs on your machine with your real key in reach - and any secret already in the prompt travels raw, straight to the provider.
Your computer
  • Agent sees your key
  • Agent reads your secrets
Key + secrets, raw
Provider
  • Gets your key
  • Gets your secrets
With poddle Work fans out to isolated pods that hold only a revocable handle. At the broker the real key is injected on the wire and stray secrets are scrubbed from the body - so nothing sensitive ever leaves the pod.
You
Prompt
self-hosted / cloud
Podweakstrong
Podweakstrong
Podweakstrong
poddle_…
AKIA…
Broker
  • Injects provider key
  • Injects connector keys
  • Scrubs body secrets
  • Enforces egress policy
GitHub Woodpecker Postgres AWS Slack
Brokered connectors
Provider key
«redacted»
Provider
  • Valid auth
  • Clean body

Without poddle

  • The local agent can read your key and your repo secrets
  • Your key and those secrets travel raw to the provider
  • The provider ends up with your real key and your secrets

With poddle

  • Pods run in a self-hosted or cloud sandbox and hold only a revocable handle
  • The broker injects the provider key and each connector credential
  • Secrets in the request body are scrubbed to «redacted:poddle»
  • The provider gets valid auth and a clean body - your key never leaves the broker

Why poddle

Secretless, governed, and provably audited.

Secretless & isolated

Secretless by construction

A broker issues revocable handles; the real secret never enters the pod.

Isolated, disposable pods

Podman-backed sandboxes, isolated per project - clean on every spin-up, gone on teardown.

Governed & audited

Governable

Pin each pod to a named egress policy - allowlist the hosts it may reach, deny the rest, down to the HTTP method - and the broker enforces it on every request. SSO/SCIM and DORA / AI-Act controls are on the roadmap.

Auditable

The broker keeps a tamper-evident, hash-chained record of every request, redaction, and handle - verifiable end to end and secret-free by construction (no bodies, no keys). Prove exactly what your agents did.

Per-person, revocable access

Every pod runs under a real identity, so what an agent did ties back to a person - and its credentials revoke at the broker in one call. Offboard a teammate or rotate a key and the pod is locked out instantly.

Built for real work

Reproducible lab templates

Pick a lab and go - podman, toolchains, and services preinstalled, interactive or headless. Spin the same environment every time, or publish your own blueprint.

Performance on demand

Start small and let poddled auto-grow a pod when it nears its memory limit; burst to a stronger shell for a headless task and drop back after. Size for the common case, not the peak.

Bring your own agent

A harness registry - claude-code today; codex, aider, pi, and local planned.

Providers & harnesses

Bring your provider. Bring your harness.

poddle wires your coding agent to your model provider through the broker - the harness installs itself in the pod, and authentication syncs to your identity. No keys to copy, nothing to configure: a remote dev environment that just works.

Providers

Anthropic

Planned

Local more coming

Harnesses

Claude Code

Planned

Pi Codex Gemini AiAider OpenCode

Connectors

Connect your world - without handing over a key.

Connect forges, pipelines, secrets, cloud, databases, and more - wired into a pod through the broker and authed on the wire, so the pod never sees a token.

GitHub Woodpecker Vault AWS Postgres Slack

See all connectors →

How it works

One broker, every workflow.

A fully-authed shell with no key inside it. Spin up, work, tear down.

  1. 1

    Add an identity

    poddle identity add work
  2. 2

    Spin up a pod

    poddle up my-sandbox --identity work
  3. 3

    Work, then tear down

    poddle down my-sandbox

Hand an agent a job and walk away - it runs in a fresh pod that's gone when it's done.

  1. 1

    Run an agent headless

    poddle task "add tests for parseConfig" --identity ci
  2. 2

    Follow it (or don't)

    poddle logs poddle-task-9f2a --follow
  3. 3

    Pod torn down after

    poddle down poddle-task-9f2a

Run against any machine over SSH. The broker stays put, so your keys never travel.

  1. 1

    Point at a host

    export PODDLE_HOST=ssh://you@build-box
  2. 2

    Same commands, remotely

    poddle up my-sandbox --identity work
  3. 3

    Keys stay on your machine

    poddle down my-sandbox

Pin an egress policy, run under it, and prove exactly what happened.

  1. 1

    Spin up under a policy

    poddle up api --policy ci --identity work
  2. 2

    Hand off a governed run

    poddle task "triage flaky tests" --template ci
  3. 3

    Audit and verify

    poddle dashboard --open

How poddle compares

Why not just isolate, or just store the key?

Isolation and secret managers each solve half of it. poddle is the only approach that keeps the real secret out of the workload entirely - injected on the wire, scrubbed from outbound traffic, and provable after the fact.

Raw agents

The agent runs with your real key in reach, and any secret already in the prompt travels raw. Fast to start, nothing to stop a leak.

Dev sandboxes

Codespaces and devcontainers isolate the environment - but the credential is injected straight into it, so a compromised pod still holds your key.

Agent code sandboxes

E2B, Daytona and Modal run agent code in a disposable box, yet you still pass the credentials in. Isolation, not secret brokering.

Secret managers

Vault and Doppler store and rotate secrets, then hand the plaintext key to the workload. A great vault, still a key inside the pod.

See the full comparison →

Give your agents a room of their own.

Secretless by construction, isolated per task, and provable after the fact. Start free in the cloud, or self-host the open-source broker - the same guarantees either way.

Start free Self-host it
  • Free tier at launch
  • No credit card
  • Open source
  • Self-host anytime