Alter
What it is
A credential vault and proxy for agents: the agent never holds the key, and sensitive calls wait for a named person.
Featured in
Issue #18 — Spare Keys · — the full issue has that week's other tools, reads, and big-lab releases.
More agents tools we've covered
- REA (Reverse Engineer Anything) Gives Claude Code, Codex or Cursor the tools to take apart native binaries, Electron apps, .NET assemblies and websites.
- AX Google's open orchestration runtime for agent workloads, in the Kubernetes idiom: you declare a Task and a Workspace in YAML — the git repos, MCP servers, and skills an agent needs — and AX runs it in a sandbox with CPU and memory limits, suspends it while it waits on a model, and resumes it in under a second. The part that matters this week is the Gateway: outbound traffic locked to an explicit allowlist of hosts and ports, with credentials injected at the edge rather than handed to the agent. Apache-2.0, written in Go.
- Cloudflare Security Audit Skill The MIT-licensed skill behind Cloudflare's internal fleet-wide vulnerability harness, installable into Claude Code or any skills-compatible agent with one `npx skills add`. It structures an audit as six phases — reconnaissance, coverage-led hunting by isolated hunter agents, adversarial validation by fresh verifier agents that never saw the hunt, schema-validated findings, independent re-verification, and a target-neutral report. Cloudflare's own funnel numbers: 20,799 raw candidates filtered to 12,057 validated and 7,245 findings engineering teams actually acted on.
- OpenExecutive An open-source virtual executive team: one coherent executive persona backed by eight specialist Claude agents — strategy, finance, HR, legal, operations, marketing, product, and board communications — with episodic memory in SQLite, a ChromaDB vector store, and interfaces for web, Slack, email, Telegram, Discord, and the CLI. Apache 2.0, FastAPI plus Next.js; clone it, add an `ANTHROPIC_API_KEY`, and `make dev` puts the corner office on localhost:3000.