enigmagent_resolve
Resolve secret placeholders from a local AES-256-GCM encrypted vault at runtime, returning decrypted values only when the requesting origin matches the secret's domain binding. Prevents LLMs from exposing API keys.
Instructions
Resolve a secret placeholder from the EnigmAgent vault. Returns the decrypted value. Domain binding is enforced: the origin must match the secret's bound domain.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| placeholder | Yes | The secret name to resolve. Supports {{NAME}}, {{LOGIN:domain}}, {{DOC:filename}} syntax (pass without the braces). | |
| origin | Yes | The requesting origin URL (e.g. https://api.example.com). Must match the secret's domain binding. |