Claude Managed Agents stores credentials in a separate vault, exposes only placeholders to the agent, and injects credentials through an egress proxy when requests leave the system.

“But one of the more important properties of this architecture is you have credentials for any, any work that the agent needs to execute, right?”

“Like, if you're gonna go talk to an MCP server or if you're gonna go, like, use a CLI or call some API, whatever you might wanna do, right? And, like, you need to authenticate those things.”

“You need to store those credentials somewhere so that the agent can use them.”

“And the way that we architected this was we have a totally separate vault where those credentials are getting stored, and as once the agent decides, like, I'm gonna go and call out to one of these services, the agent only ever sees, like, a placeholder, right?”

“And, like, on egress, we have a proxy that goes and, like, pulls the right credential out and injects it and lets that out.”