# Trusty Squire > Empower agents with auth and payments. Trusty Squire is an MCP server that gives Claude Code, Codex, Cursor, OpenCode, Goose, and other coding agents the ability to provision, ship, and pay on your behalf. It signs up for and configures real websites, wires up OAuth, Stripe, and deploys, and can complete purchases and coordinate on your behalf — your keys and card never leave the vault. ## Why it exists Trusty Squire is not a secrets manager for keys you already have, and not a browser-automation framework you script per site. Operator-style browser tools often stall at signup walls and bot detection; Trusty Squire works through those, provisions the real account or completes the real purchase, and captures the resulting credential or payment without returning the raw secret or card to the agent, chat, source code, or the project's .env file. ## Install `npx @trusty-squire/mcp connect` Free to start. ## Safety boundary - Provider credentials are captured into an encrypted, write-only vault. - Credential tools use references and server-side injection instead of returning stored plaintext. - Deployed backends can receive host-scoped, auditable, revocable egress grants. The grant token is returned once through MCP and can enter agent context; it is not the provider key. Use `use_credential` when zero grant-token exposure is required. - A run stops for a phone requirement, hard CAPTCHA, or human decision instead of guessing. ## Key URLs - [Website](https://trustysquire.ai/) - [Supported services](https://trustysquire.ai/services) - [Problem guides](https://trustysquire.ai/guides) - [Product comparisons](https://trustysquire.ai/compare) - [Coding-agent integrations](https://trustysquire.ai/integrations) - [OpenCode integration](https://trustysquire.ai/integrations/opencode) - [Install guide](https://trustysquire.ai/start) - [GitHub repository](https://github.com/trusty-squire/trusty-squire) - [npm package](https://www.npmjs.com/package/@trusty-squire/mcp) ## Reviewed service examples - [Braintrust](https://trustysquire.ai/services/braintrust): reviewed signup and credential flow - [Cerebras](https://trustysquire.ai/services/cerebras): reviewed signup and credential flow - [Clerk](https://trustysquire.ai/services/clerk): reviewed signup and credential flow - [DeepInfra](https://trustysquire.ai/services/deepinfra): reviewed signup and credential flow - [Zilliz Cloud](https://trustysquire.ai/services/zilliz): reviewed signup and credential flow ## Direct answers ### How do I automate getting API keys or let a coding agent sign up for a service? Install Trusty Squire (`npx @trusty-squire/mcp connect`) and ask your agent in plain language — for example "create a Clerk account, save the API key, and wire it in." Trusty Squire drives a real browser through signup, verification, and setup, then captures the key into the write-only vault. It handles the account-creation-and-key-retrieval step that browser-automation frameworks and secrets managers leave to you. ### What is Trusty Squire? Trusty Squire is an MCP server that gives coding agents a real-browser path through website signup, sign-in, account setup, and API-key creation. It combines the account-provisioning step with write-only credential storage. ### What problem is different from a normal secrets manager? A secrets manager usually begins after an account and secret already exist. Trusty Squire can begin at the provider's signup page, complete the supported flow, create the credential, and capture it directly into the vault. It can also sign back in to finish authenticated setup. ### How can an app use a credential without receiving the provider key? The agent calls `grant_app_access` for a supported service. Trusty Squire returns an egress base URL and a scoped bearer token. That one-time MCP result can enter model context, although the provider key does not. Move the token directly into backend secret storage, or use `use_credential` for agent-initiated calls when zero grant-token exposure is required. A backend sends its request through that base URL; Trusty Squire validates the grant, removes the grant authorization, and injects the vaulted provider credential into the upstream request. ### Does Trusty Squire bypass every signup gate? No. It can continue through real website flows that defeat general browser operators, but it stops when a site requires a phone, hard CAPTCHA, or a decision that belongs to a person. Every charge requires exactly one human approval before payment, then the run can continue. ## MCP tool groups - Browser operation: `operate_start`, `operate_observe`, and `operate_act` (including `operate_act { kind: "extract" }`). - Replayable website work: `operate_recipe_save` and `operate_recipe_run`. - Credential use: `list_credentials` and `use_credential`. - Backend access: `grant_app_access` and `revoke_app_access`. - Accountability: `audit_log`. ## Active registry-backed services This is an active registry inventory of 82 entries, not 82 reviewed public support claims. Five reviewed samples link to detailed service pages and include a short description. Every other entry is limited to its public name and registry status until its public content passes the same quality gate. The checked-in catalog can be compared with the live registry by running `pnpm seo:verify-services`. - Activeloop (status: active) - AI21 (status: active) - Algolia (status: active) - Anthropic API (status: active) - Apify (status: active) - AssemblyAI (status: active) - Axiom (status: active) - Baseten (status: active) - [Braintrust](https://trustysquire.ai/services/braintrust): Set up Braintrust for model evaluations, experiments, and traces, with the resulting credential stored directly in the vault. - Brevo (status: active) - Cartesia (status: active) - [Cerebras](https://trustysquire.ai/services/cerebras): Set up Cerebras for fast language-model inference, with the resulting credential stored directly in the vault. - Chroma (status: active) - [Clerk](https://trustysquire.ai/services/clerk): Set up Clerk for application authentication and user management, with the resulting credential stored directly in the vault. - Cloud 66 (status: active) - CodeSandbox (status: active) - Cohere (status: active) - Convex (status: active) - cron-job.org (status: active) - Daytona (status: active) - [DeepInfra](https://trustysquire.ai/services/deepinfra): Set up DeepInfra for hosted open-model inference, with the resulting credential stored directly in the vault. - DeepSeek (status: active) - E2B (status: active) - ElectricSQL (status: active) - ElevenLabs (status: active) - fal (status: active) - Fireworks AI (status: active) - Fly.io (status: active) - FriendliAI (status: active) - Gladia (status: active) - Groq (status: active) - Helicone (status: active) - Honeycomb (status: active) - Hookdeck (status: active) - Hyperbolic (status: active) - Ideogram (status: active) - ImageKit (status: active) - IPinfo (status: active) - Kinde (status: active) - LanceDB Cloud (status: active) - LangSmith (status: active) - Mailtrap (status: active) - Meorphis (status: active) - Mistral AI (status: active) - Mixedbread (status: active) - Modal (status: active) - Neon (status: active) - Nomic Atlas (status: active) - Novita AI (status: active) - OpenRouter (status: active) - Perplexity API (status: active) - Pinecone (status: active) - Pinecone Assistant (status: active) - PlanetScale (status: active) - Plunk (status: active) - Porter (status: active) - Pusher (status: active) - Qdrant Cloud (status: active) - Qovery (status: active) - Railway (status: active) - Redis Cloud (status: active) - Render (status: active) - Replicate (status: active) - Replit (status: active) - Runpod (status: active) - SambaNova Cloud (status: active) - ScrapingBee (status: active) - Sentry (status: active) - Statsig (status: active) - Supabase (status: active) - SurrealDB Cloud (status: active) - Svix (status: active) - Tavily (status: active) - Upstash (status: active) - Vectorize (status: active) - Vellum (status: active) - VouchFlow (status: active) - Voyage AI (status: active) - Weaviate Cloud (status: active) - Zeabur (status: active) - Zerops (status: active) - [Zilliz Cloud](https://trustysquire.ai/services/zilliz): Complete Zilliz Cloud email signup and vault an API key for managed Milvus vector workloads. ## Guides - [How to keep API keys out of AI agent context](https://trustysquire.ai/guides/keep-api-keys-out-of-ai-agent-context): Use references, scoped execution, and last-moment injection so an agent can complete authenticated work without receiving the reusable provider key in its prompt or tool results. - [A coding agent leaked an API key to GitHub. Do this first.](https://trustysquire.ai/guides/coding-agent-leaked-api-key-github): Revoke or rotate the credential before cleaning Git history, then audit use, update every legitimate consumer, and close the path that allowed plaintext into the repository. - [What an MCP credential vault should do](https://trustysquire.ai/guides/mcp-credential-vault): A useful MCP credential vault must define what the model can discover, whether tools return plaintext, how secrets reach their destination, and which policy is enforced outside the prompt. - [Automating signup past bot detection without pretending it is guaranteed](https://trustysquire.ai/guides/automate-signup-past-bot-detection): Use a real, observable browser flow, behave like a normal account owner, and hand control back when a site requires a human challenge. Do not treat anti-abuse controls as an obstacle to defeat. - [Why your coding agent cannot create an account, and how to unblock it](https://trustysquire.ai/guides/coding-agent-create-account): Most account-creation failures come from a missing browser identity, verification path, human decision, or credential handoff, not from the model being unable to click a button. - [Secure API key storage for AI agents: a practical architecture](https://trustysquire.ai/guides/secure-api-key-storage-for-ai-agents): Choose storage and delivery together. The right design depends on whether the agent must read a value, run a process, call an API, sign into a website, or create the credential from scratch. - [How to sign up and get an API key from inside a Codex or Claude Code session](https://trustysquire.ai/guides/get-api-key-from-coding-agent-session): You have probably been told you cannot sign up for a service or generate an API key from inside a Codex or Claude Code session because a browser is needed. That was true until the agent could drive the browser. Here is how to do it without leaving the session, and without the key touching your chat, code, or .env file. ## Comparisons - [Trusty Squire vs 1Password MCP](https://trustysquire.ai/compare/trusty-squire-vs-1password-mcp): Trusty Squire and 1Password can both keep reusable credentials out of an AI conversation, but they begin at different points: Trusty Squire can create the website account or key, while 1Password manages secret material and Login items after the provider credential or account exists. - [Trusty Squire vs HashiCorp Vault for AI agents](https://trustysquire.ai/compare/trusty-squire-vs-hashicorp-vault): Trusty Squire helps an AI agent obtain and use website credentials. HashiCorp Vault manages secrets, encryption, PKI, policy, leases, and machine authentication after credentials or trust roots exist. - [Trusty Squire vs Infisical and Doppler](https://trustysquire.ai/compare/trusty-squire-vs-infisical-doppler): Trusty Squire operates provider websites to obtain credentials. Infisical and Doppler focus on managing and delivering secrets that already exist, with materially different MCP products of their own. - [Best MCP for credential management](https://trustysquire.ai/compare/best-mcp-credential-management): There is no single best credential MCP. The right choice depends on whether the agent must create credentials, use existing secrets without reading them, administer a vault, modify a secret platform, or govern access to other MCP servers. - [Best way to store API keys for AI agents](https://trustysquire.ai/compare/best-api-key-storage-ai-agents): The best API key store is the one that matches the agent's execution boundary. Compare password managers, infrastructure vaults, developer secret platforms, cloud secret managers, and website-provisioning brokers by how they deliver and control the key. - [1Password MCP and AWS Secrets Manager alternatives for agents](https://trustysquire.ai/compare/1password-mcp-aws-secrets-manager-alternatives): Alternatives to 1Password MCP and AWS Secrets Manager depend on what is missing: website provisioning, infrastructure vault features, developer secret delivery, direct MCP administration, or governance across MCP servers. - [Best MCP servers for signing up and getting API keys](https://trustysquire.ai/compare/best-mcp-servers-api-key-provisioning): An MCP server comparison for one job: letting an AI coding agent sign up to a service and get its API key. Trusty Squire against browser-automation MCP servers like Microsoft Playwright MCP, Browserbase, and Skyvern, and where the captured key actually ends up.