UnYOLO: Credential broker that keeps GitHub tokens away from AI agents

UnYOLO sits between your AI agents and GitHub, handing out short-lived proxy credentials instead of letting agents touch real tokens.

What the broker does:

• Isolation — agent never holds, sees, or transmits a real credential; it receives only the API response it’s allowed to see
• Short-lived credentials — proxy tokens expire in seconds to minutes, bound to the agent’s cryptographic identity via DPoP (RFC 9449)
• TLS termination — broker runs its own CA, installed as a trust anchor on the agent host, decrypts traffic, inspects requests, then opens a fresh TLS connection upstream
• Separated concerns — policy engine and credential store are split, so compromising one doesn’t yield the other
• Audit trail — every request and response is logged and filterable in real time

The threat model is the confused deputy problem. AI agents act on whatever text they read — a GitHub issue, a file, a web page — which makes them exploitable in ways deterministic software isn’t. A prompt injection in an issue comment could instruct an agent to exfiltrate a GitHub token. If the agent never holds the token, there’s nothing to exfiltrate.

Available now at unyolo.io. If you’re running AI agents against GitHub repos with write access, this is the architecture that stops a prompt injection from becoming a token leak.