Cordon by Codezero

The missing credential containment layer.

Credentials are encrypted at rest in vaults and secrets managers, encrypted in transit over TLS, and then handed to applications in plaintext. Once inside a runtime, they leak through logs, crash dumps, environment variables, child processes, debug endpoints, dependency supply chains, and memory dumps. No amount of protection at rest helps once a secret is in memory and the application (or one of its dependencies) can read it.

AI agents are making this exponentially worse. They execute code, install packages, call APIs, and spawn subprocesses autonomously. Every tool an agent invokes is another runtime where a credential can be captured, exfiltrated, or misused. The attack surface grows with every agent you deploy, and traditional secret management was never designed for runtimes you don't fully control.

Possession is the vulnerability. The only way to eliminate it is to keep credentials out of the runtime entirely.

This package contains the developer edition of Cordon, part of the Codezero Credential Containment Layer. It intercepts outbound HTTP/HTTPS requests and TCP connections (PostgreSQL today, more protocols coming) and injects credentials from 1Password or your OS keyring at the network layer. Applications and AI agents make normal network calls through the proxy and never see, store, or log a single secret.

Your App  ──HTTPS_PROXY──▶  Cordon  ──real credentials──▶  api.stripe.com
Your App  ──TCP connect──▶  Cordon  ──real credentials──▶  db.example.com:5432
                                      (from 1Password
                                       or OS keyring)

No code changes. No SDK wrappers. Credentials are applied in transit and never enter your runtime.

Install

npm install -g @codezero-io/cordon

This automatically installs a platform-specific binary package for your OS and architecture. Requires macOS (ARM64/x64) or Linux (x64/ARM64) and Node.js 20.18.1+.

Quick Start

cordon setup

One command. The setup wizard generates CA certificates, creates your config, detects available secret providers, and walks you through adding your first route and secret. For AI agent integrations, use cordon setup claude-code (or codex, cursor, hermes) to also configure the tool's proxy and trust settings.

Then start the proxy:

cordon start

See the Quickstart guide for a complete walkthrough.

AI Agent Integrations

Cordon has dedicated setup for AI coding agents. Each configures proxy environment variables, CA trust, and tool-specific settings:

cordon setup claude-code   # Claude Code
cordon setup codex         # OpenAI Codex
cordon setup cursor        # Cursor
cordon setup hermes        # Hermes Agent

See the integration guides for details.

The @codezero-io/cordon/register import patches globalThis.fetch to route all outbound requests through cordon transparently. This works for fetch-based AI SDKs (Anthropic, OpenAI) without any code changes.

You can also use it as a direct import if NODE_OPTIONS isn't available:

import '@codezero-io/cordon/register';  // must be the first import

Axios

Axios does not use Node's global fetch, so it needs a small helper instead of the register import.

Create a preconfigured client:

import { createCordonAxios } from "@codezero-io/cordon/axios";

const client = createCordonAxios({
  baseURL: "https://api.openai.com",
});

Or apply Cordon's proxy settings to an existing axios.create() wrapper:

import axios from "axios";
import { getCordonAxiosProxyConfig } from "@codezero-io/cordon/axios";

const client = axios.create({
  timeout: 10_000,
  ...getCordonAxiosProxyConfig(),
});

This helper uses your existing HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables. Your app still needs axios installed.

When proxy env vars are set, the helper intentionally overrides any httpAgent, httpsAgent, or proxy values in the axios config so Cordon controls the outbound route.

Security

Cordon is designed so that security properties are structural, not configuration-dependent. There are no flags or options that weaken the security posture.

• Credentials never enter your runtime. Fetched from your secret store and injected at the network layer, per-request.
• Loopback only. The config accepts a port number, not a bind address. Non-loopback binding is structurally impossible.
• SSRF protection. Built-in denylist blocks forwarding to private IPs, link-local, and loopback addresses for non-route traffic. Always on, not configurable. Resolves DNS before connecting to prevent rebinding attacks.
• Never logs secrets. The Secret type has no Debug or Display impl. Attempts to log secrets fail at compile time.
• Zeroized on drop. Secret memory is zeroed when no longer needed.
• No telemetry. Makes no network calls except to configured upstreams and your secret provider.

See the Security Model and Threat Model for full details.

Report security issues to [email protected].

Documentation

Full documentation: docs.codezero.io

Codezero Platform

This package is the free local developer edition of Cordon. The Codezero platform extends credential containment beyond the developer's machine:

• Managed Service: centralized credential governance, audit logging, and policy enforcement without self-hosting
• Self-Hosted: deploy within your own infrastructure with enterprise vault integrations (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault), OIDC/SSO identity binding, and OPA-based access policies

Credentials never reach the application runtime in any deployment model. Learn more at codezero.io.

License

Codezero Cordon Developer License Agreement. The Developer edition is provided at no charge within Developer Limits. Teams and Enterprise features are available under a paid commercial license.