agent-deepweb

Profiles by name — LLM says --profile github, never sees the token

Five auth types — bearer, basic, cookie, custom header, form-login with cookie harvest

macOS Keychain + encrypted cookie jars — AES-256-GCM with per-profile keys

Request allowlists — per-profile host and path guards; redirects can't escape

Response redaction — headers, JSON fields, and literal-byte echoes masked in output

Templates — frozen request shapes authored by the human; LLM only fills parameters

Import sources — OpenAPI v3 / Swagger 2.0, GraphQL introspection, Postman, HAR, .http, curl

First-class JSON-RPC 2.0 verb alongside REST and GraphQL

Classified errors — every error includes fixable_by: agent|human|retry

Append-only audit log — every request written to ~/.config/agent-deepweb/audit.log

Passphrase-gated escalation — widening an allowlist, rotating a secret, setting a default header, allowing http or unmasking a cookie all need a short friendly phrase the human knows and the LLM does not

Bring-your-own jar — --cookiejar <path> lets an agent author a whole signup-then-authenticated-call flow without a registered profile; the jar is deliberately plaintext because the caller picked the path

Cookie sensitivity is classified, not guessed — HttpOnly plus name patterns mask values in jar show, with an explicit human override either way

Plain http refused for authenticated requests unless loopback, or opted into per profile

Redirects cannot escape the allowlist — a cross-allowlist hop is refused rather than followed