# Fullmakt

> Fullmakt is a credential broker for AI agents — it issues scoped, short-lived credentials to agents, enforces what each one may do, and audits every call, so your API keys never reach the model.

Fullmakt sits between your AI agents and the APIs they call. A human provisions the real credentials once; agents then authenticate with OAuth 2.0 client credentials and receive a short-lived, scoped token instead. Every call is checked against a policy (allow, deny, or hold for human approval), the real credential is injected server-side, the response is sanitized, and the whole exchange lands in a tamper-proof audit log. Agents reach it over A2A or MCP.

Common problems it solves: an agent holding a long-lived API key; no record of what an agent actually did; no way to revoke one agent without rotating a shared secret; MCP tools that change after you approved them; secrets leaking into model context or logs.

Adjacent categories: secrets management, non-human / machine identity, AI agent access control, API gateway, identity provider. Fullmakt is none of these on its own — it brokers per-agent access to APIs and proves what each agent did, alongside whichever IdP and secret store you already run.

## Product

- [Home](https://fullmakt.ai/): what Fullmakt is, how the broker works, features, pricing and FAQ
- [Pricing](https://fullmakt.ai/#pricing): usage-based, no plans and no minimums — metered per brokered request, per AI-generated collection and per generated endpoint, billed monthly
- [API testing workbench](https://fullmakt.ai/api-testing): the request workbench — import Postman collections, generate collections from a URL, capture live traffic, run HTTP, GraphQL, WebSocket, gRPC and MCP requests
- [Sign up](https://fullmakt.ai/signup): create an account (sandbox first, no card)
- [Privacy](https://fullmakt.ai/privacy): data handling for the hosted service

## Docs

- [Connect an agent](https://fullmakt.ai/docs/agents): how an AI agent authenticates and calls Fullmakt, end to end
- [A2A management surface](https://fullmakt.ai/docs/agents#a2a): Agent Card discovery and the JSON-RPC skills that manage a workspace
- [MCP execution surface](https://fullmakt.ai/docs/agents#mcp): per-collection MCP servers that turn saved requests into tools
- [Discovery endpoints](https://fullmakt.ai/docs/agents#discovery): the well-known URLs an agent reads before connecting
- [Agent Card](https://fullmakt.ai/.well-known/agent-card.json): machine-readable A2A entry point (JSON, no auth)

## Blog

- [All posts](https://fullmakt.ai/blog): the full index, newest first
- [The Enterprise Security Questionnaire for AI Agents: 10 Questions Buyers Ask, and Evidence to Answer Them](https://fullmakt.ai/blog/enterprise-security-questionnaire-ai-agents-answers): Enterprise buyers now ask how your AI agents authenticate, what they can reach and how actions are traced. Ten questions across MCP and A2A, and the evidence that closes deals.
- [Workload Identity Proves Who the Agent Is. It Doesn't Say What It May Do.](https://fullmakt.ai/blog/workload-identity-vs-credential-broker-ai-agents): Cloud workload identity and SPIFFE answer who is calling. AI agents also need scoped credentials, policy and an audit trail across MCP and A2A. Here is how the layers fit.
- [Headless Agents Can't Log In: Device Flow, CIBA and Out-of-Band Approval](https://fullmakt.ai/blog/device-flow-ciba-headless-agents-human-approval): An AI agent has no browser, so who types the password? How OAuth device flow and CIBA ask a human to approve, how they get phished, and how a broker keeps approval out of band.
- [Who Is This MCP Client? Dynamic Registration, CIMD and Consent](https://fullmakt.ai/blog/mcp-client-identity-dynamic-registration-cimd-consent): Any MCP client can register itself and ask for access. How dynamic client registration, CIMD and redirect URI checks work, and how a fake client phishes consent.
- [AI Agent Audit Log Integrity: Is Append-Only Enough?](https://fullmakt.ai/blog/ai-agent-audit-log-integrity-append-only): An audit log is only evidence if it is complete and hard to alter. What AI agent audit trails must capture, where they lose rows, and how to fix it.
- [MCP Session Hijacking: Why Session IDs Aren't Authentication for AI Agents](https://fullmakt.ai/blog/mcp-session-hijacking-stateless-auth-ai-agents): An MCP session ID is a handle, not a credential. How session hijacking and event injection hit AI agents, and why per-request auth and a credential broker contain it.
- [Signed Task Envelopes: Proving an AI Agent Meant to Make That Call](https://fullmakt.ai/blog/signed-task-envelopes-ai-agent-actions-replay): A valid token proves who an AI agent is, not what it intended. Learn how signed per-call task envelopes stop replay and tampering in MCP and A2A agent actions.
- [Your AI Agent Guardrail Might Be Switched Off: Fail-Open Policies and How to Test Them](https://fullmakt.ai/blog/ai-agent-policy-fails-open-test-guardrails): A typo in an AI agent policy can silently allow everything. Learn how fail-open guardrails happen, how to test agent policies before saving, and how a broker helps.
- [Leaked AI Agent API Key? Why Rotation Is a Five-Minute Job With a Credential Broker and a Week-Long Hunt Without One](https://fullmakt.ai/blog/rotate-leaked-ai-agent-api-key-credential-broker): When an AI agent leaks an API key, the real cost is finding every copy. See how a credential broker turns rotation into a one-place change with a clear audit trail.
- [Build vs Buy: The Homegrown AI Agent Credential Proxy Is Never Just a Proxy](https://fullmakt.ai/blog/build-vs-buy-ai-agent-credential-proxy): Teams often build a thin proxy to keep API keys away from AI agents. Here's what that proxy quietly grows into, and when a credential broker is the cheaper path.
- [MCP Token Passthrough: The Shortcut That Turns Your Server Into a Confused Deputy](https://fullmakt.ai/blog/mcp-token-passthrough-audience-binding): Forwarding the token an MCP client sent to a downstream API feels harmless. It breaks audience binding, erases traceability and hands one stolen token the keys to everything. Here's the fix.
- [Browser-Use AI Agents and Logins: Why Passwords, MFA and Session Cookies Don't Belong in the Prompt](https://fullmakt.ai/blog/browser-agents-passwords-mfa-login-handshake): Computer-use and browser agents log in like humans, with passwords, MFA codes and cookies. How that goes wrong, and how an API credential broker keeps logins out of the model.
- [Agent Memory Is a Data Store Nobody Governs: Ownership, Poisoning, and Traceability](https://fullmakt.ai/blog/agent-memory-data-ownership-governance): Persistent AI agent memory quietly becomes a copy of your customer data, credentials and instructions. How memory goes wrong, and how a broker keeps it traceable and ownable.
- [The Return Trip Problem: Your Agent's Data Leaves Through the Response, Not the Request](https://fullmakt.ai/blog/agent-data-egress-response-sanitization-data-ownership): Most AI agent governance gates what an agent may call. Data ownership is decided by what comes back. How response-side leakage happens, and how a broker sanitizes and traces it.
- [The Downgrade Attack Hiding Inside Your A2A and MCP Handshake](https://fullmakt.ai/blog/protocol-downgrade-a2a-mcp-login-handshake): A2A and MCP both let client and server negotiate a protocol version at connect time. Neither side is required to refuse a downgrade — and most implementations don't.
- [MCP Resources and Prompts: The Primitives Your Policy Engine Never Learned to Gate](https://fullmakt.ai/blog/mcp-resources-prompts-policy-gate-blind-spot): MCP tools aren't the only way to reach data. Resources and prompts are separate RPC methods a tool-call policy engine never sees go by.
- [Indirect Prompt Injection: The Attack That Lives in the Data, Not the Prompt](https://fullmakt.ai/blog/indirect-prompt-injection-mcp-a2a-credential-containment): Indirect prompt injection hides instructions in tool results and A2A messages, not the prompt. Why it evades detection, and how credential-layer containment limits the damage.
- [The act Claim Nobody Checks: OAuth Token Exchange and the A2A Delegation Chain](https://fullmakt.ai/blog/oauth-token-exchange-rfc8693-a2a-delegation-chain): RFC 8693 gives OAuth a real mechanism for chained delegation — the act claim. Most A2A deployments don't use it, and the ones that do rarely verify it. Here's what that costs, and how a broker closes the gap.
- [MCP Elicitation and Sampling: The Handshake That Skips Your Credential Broker](https://fullmakt.ai/blog/mcp-elicitation-sampling-credential-phishing): MCP lets a tool server ask the human directly for input, or borrow the host's model for a completion — both a legitimate way around every control a credential broker enforces.
- [GDPR and AI Agents: Data Ownership Doesn't Survive an A2A Handoff by Default](https://fullmakt.ai/blog/gdpr-data-ownership-ai-agent-a2a-delegation): GDPR draws a clean line between controller and processor. An AI agent that delegates a subtask to another agent over A2A can cross that line mid-task, invisibly. Why that's a compliance gap, and how a broker keeps it visible.
- [Bearer Tokens Weren't Built for Agents: DPoP and the Sender-Constrained Login Handshake](https://fullmakt.ai/blog/dpop-sender-constrained-tokens-ai-agents): A stolen bearer token works for anyone who holds it. DPoP binds it to the key that requested it — why that matters far more for AI agents than browsers.
- [A2A Push Notifications Are a Second Front Door — and Most Agents Leave It Unlocked](https://fullmakt.ai/blog/a2a-push-notification-webhook-authentication): A2A's push-notification webhooks let a long-running task call back when it's done. Most teams harden the handshake that starts a task and wave through the one that ends it.
- [contextId Isn't a Trace ID: The Gap in A2A and MCP's Own Correlation Fields](https://fullmakt.ai/blog/multi-agent-trace-propagation-a2a-mcp-observability): A2A gives you contextId and taskId. MCP gives you Mcp-Session-Id. Neither was built to follow a request past the hop it was issued for — here's the gap that leaves, and how a broker closes it.
- [The Ratchet Effect: Why AI Agent Permissions Only Go Up](https://fullmakt.ai/blog/ai-agent-permission-creep-least-privilege-drift): Every AI agent's access grows over time and almost never shrinks. Why permission creep is a data-ownership risk hiding in plain sight, and how scoped, short-lived credentials fix it by design.
- [The Alert Fired. The Agent Kept Spending.](https://fullmakt.ai/blog/runaway-agent-spend-soft-caps-hard-stops): An alert isn't a stop. Runaway agentic spend is a governance gap identity checks and allow/deny policies both miss — and what actually halts the loop.
- [SOC 2 for AI Agents: The Control Matrix Wasn't Built for a Caller That Isn't a Person](https://fullmakt.ai/blog/soc-2-ai-agents-audit-controls): SOC 2's access controls assume a human logging in, reviewed quarterly. An agent making thousands of calls a day breaks that model — here's what auditors actually need instead.
- [Approval Fatigue: When Human-in-the-Loop Becomes a Rubber Stamp](https://fullmakt.ai/blog/approval-fatigue-human-in-the-loop-ai-agents): Human approval gates are the standard answer to risky agent actions. At volume, review turns into a reflex click — and the control quietly stops controlling anything.
- [One Login, Many Users: How Cached Tokens Leak Across Sessions in Agentic AI](https://fullmakt.ai/blog/cached-tokens-cross-user-session-bleed-ai-agents): Agent middleware authenticates once and reuses the connection for speed — standard practice for a service credential. When the cached token belongs to one end user, that same pattern quietly hands their login handshake to the next request.
- [After the Agent Goes Wrong: What Incident Forensics Actually Needs From Your Audit Trail](https://fullmakt.ai/blog/agent-incident-forensics-audit-trail): When an AI agent goes wrong, most audit setups can only tell you an API call happened — not what authorized it, what order it fired in, or how far the damage spread.
- [When One Agent Becomes Ten: Parallel Sub-Agent Fan-Out Breaks Credential Attribution](https://fullmakt.ai/blog/parallel-subagent-fanout-shared-credentials): Orchestrators spin up parallel sub-agents that share one task credential. When ten branches call the same API in the same second, audit logs collapse into an unattributable blur and budget checks race each other. Why fan-out needs per-branch tokens, not a bigger session ID.
- [The 202 Pattern: Why Agentic AI Needs a Pause Button, Not Just a Policy](https://fullmakt.ai/blog/human-in-the-loop-approval-agentic-ai): Allow and deny cover most agentic actions. The ones that don't fit either box need a third answer: pause, notify a human, and let a short-lived, one-shot approval — not a standing yes — unlock the call.
- [Non-Human Identity Governance Wasn't Built for Agents That Improvise](https://fullmakt.ai/blog/non-human-identity-governance-ai-agents): NHI programs inventory service accounts and rotate API keys on a schedule. AI agents break both assumptions. Why non-human identity governance needs a broker for agentic AI, not just a bigger spreadsheet.
- [The Kill Switch Nobody Built: Stopping an AI Agent Mid-Incident](https://fullmakt.ai/blog/ai-agent-kill-switch-circuit-breaker): A login handshake proves an agent can start acting. Almost nothing in most stacks proves you can make it stop. Why agentic AI needs a real-time kill switch, not just revocation after the fact, and where a broker makes that possible.
- [The MCP Server You Just Installed: A Supply-Chain Problem Wearing a Tool Icon](https://fullmakt.ai/blog/mcp-server-supply-chain-credential-trust): An MCP server is third-party code with a direct line to your credentials. Why MCP's supply chain needs the scrutiny of any dependency — and why the fix belongs at the credential broker, not the install step.
- [Decision Tokens: Why 'Allowed' and 'Here's the Secret' Must Be Two Different Answers](https://fullmakt.ai/blog/decision-tokens-credential-dispensing-ai-agents): Most AI agent credential systems check permission and hand over the secret in the same step. Splitting authorization from dispensing — with a short-lived decision token in between — closes the gap that lets a revoked agent keep acting.
- [The Agent Retried the Call: Idempotency and the Duplicate-Action Failure Mode](https://fullmakt.ai/blog/idempotency-duplicate-agentic-actions-gone-wrong): An AI agent that can't tell if its last call succeeded will retry it. Without idempotency, that retry is a second refund, a second email, a second production deploy. Why this agentic-AI-gone-wrong pattern needs a broker-level fix.
- [The MCP Rug Pull: When the Tool Your Agent Approved Isn't the Tool It's Calling](https://fullmakt.ai/blog/mcp-rug-pull-tool-schema-drift): A human approves an MCP server's tools once. Nothing stops the server from changing them afterward. What an MCP rug pull actually does, why the login handshake can't catch it, and how per-call verification does.
- [A2A Skill Poisoning: A Legitimate Agent Card Can Still Talk Your Agent Into Too Much](https://fullmakt.ai/blog/a2a-skill-poisoning-agent-card-descriptions): A2A skill poisoning: the destination is legitimate, but a skill's free-text description talks a well-authenticated agent into an oversized or misconfigured call.
- [MCP Rug Pulls: When the Tool You Approved Isn't the Tool You're Calling](https://fullmakt.ai/blog/mcp-rug-pull-tool-poisoning-login-handshake): An MCP tool reviewed once can be silently rewritten later. Why login handshakes and one-time approval miss a rug pull, and how per-call verification catches it.
- [Agent Card Spoofing: The A2A Discovery Step Your Login Handshake Doesn't Protect](https://fullmakt.ai/blog/a2a-agent-card-spoofing-discovery-handshake): A2A agents discover each other via an unauthenticated Agent Card. If that step is spoofed, a valid login handshake still authenticates to the wrong party.
- [The Refresh Token Nobody Should Give an AI Agent](https://fullmakt.ai/blog/refresh-tokens-ai-agents-login-handshake): OAuth's refresh token exists so a human who steps away doesn't have to log in again. An AI agent never steps away. Why that mismatch recreates the standing-credential problem — and the login handshake that avoids it.
- [On Whose Behalf? The Identity Question Agentic AI's Login Handshake Skips](https://fullmakt.ai/blog/on-behalf-of-agent-identity-delegation): An AI agent's login handshake proves which agent is calling. It rarely proves who the agent is acting for. Why that gap matters for A2A and MCP delegation chains, and how a broker closes it.
- [The Observability Trap: When Watching Your AI Agents Becomes the Leak](https://fullmakt.ai/blog/audit-log-observability-credential-leak-ai-agents): Teams build detailed logs and traces to catch AI agents gone wrong — then those same logs end up holding the credentials and customer data they were meant to protect. Here's the redaction gap, and how to close it.
- [Login Handshake Procedures for AI Agents: API Keys, OAuth, mTLS, and Token Exchange Compared](https://fullmakt.ai/blog/login-handshake-procedures-ai-agents-compared): API keys, OAuth client-credentials, device flow, mTLS, and token exchange all authenticate AI agents differently. What each handshake actually proves, where it breaks down, and why the handshake was never the hard part.
- [Six Real AI Agents Gone Wrong, and the Governance Failure Behind Each One](https://fullmakt.ai/blog/six-ai-agents-gone-wrong-governance-lessons): From a coding agent that deleted a production database to a chatbot that invented a policy — six real AI agent incidents and the credential, authorization, and audit gaps behind each.
- [AI Agents Need an Offboarding Process Too: The Login Handshake Nobody Revokes](https://fullmakt.ai/blog/ai-agent-offboarding-credential-revocation): Every AI agent outlives the task it was built for. Why agent offboarding is a governance and data-ownership gap, not just security hygiene, and how a credential broker makes revocation instant.
- [SSRF and Agentic AI Gone Wrong: The Login Handshake Was Never the Problem](https://fullmakt.ai/blog/ssrf-agentic-ai-gone-wrong): An AI agent can pass every login handshake and still be tricked into calling your cloud metadata endpoint. How SSRF turns a legitimate agentic action into an incident, and where the guard actually has to live.
- [The Lethal Trifecta: Closing Agentic AI's Data-Exfiltration Gap](https://fullmakt.ai/blog/lethal-trifecta-agentic-ai-observability-credentials): Private data, untrusted content, and an exfiltration path — the 'lethal trifecta' behind agentic AI gone wrong, and why credential-layer observability closes it.
- [MCP Tool Poisoning: The Confused-Deputy Failure Mode Behind Agentic AI Gone Wrong](https://fullmakt.ai/blog/mcp-tool-poisoning-confused-deputy-agents): A malicious tool description can turn a well-authenticated AI agent into a confused deputy. How MCP tool poisoning works, why login handshakes alone don't stop it, and the broker pattern that does.
- [MCP Tool Poisoning Is a Login Handshake Problem, Not a Prompt Problem](https://fullmakt.ai/blog/mcp-tool-poisoning-observability-broker): MCP's OAuth handshake proves an agent connected to your server. It says nothing about what a tool description talked the agent into doing next. Why MCP incidents keep happening at the tool layer, and how a broker closes the gap.
- [The MCP Confused Deputy: How 'It Has a Valid Token' Still Goes Wrong](https://fullmakt.ai/blog/mcp-confused-deputy-agentic-ai-gone-wrong): A valid MCP token doesn't mean a wise call. The confused deputy problem in agentic AI, and how a broker enforces policy on every tool call, not just the connection.
- [The A2A Protocol Changes the Login Handshake: Governing Agents That Manage Agents](https://fullmakt.ai/blog/a2a-protocol-agent-to-agent-governance): A2A lets one AI agent configure another system, not just call its tools — a bigger blast radius than MCP. Here's the handshake and credential carve-out that makes it safe.
- [The A2A Handshake: What Agent2Agent Authentication Actually Proves](https://fullmakt.ai/blog/a2a-protocol-handshake-ai-agents): The A2A protocol standardizes how AI agents authenticate to each other. What the handshake proves, what it doesn't, and why every call still needs a broker behind it.
- [Shadow AI Agents: The Governance Blind Spot Nobody's Counting](https://fullmakt.ai/blog/shadow-ai-agents-governance-blind-spot): Every team wiring an AI agent to an API mints its own credential. Nobody centrally counts them. Here's why shadow AI agents are a data-ownership and traceability problem, not just a security one — and how a broker fixes it.
- [Data Ownership in Agentic AI: Three Failure Patterns, and the Broker That Stops Them](https://fullmakt.ai/blog/data-ownership-agentic-ai-failure-patterns): AI agents rarely fail by being unauthenticated. They fail by losing track of whose data they're touching. Three real failure patterns in agentic AI, and how a credential broker enforces data ownership on every call.
- [Observability vs. Traceability for AI Agents: Why One Audit Log Isn't Enough](https://fullmakt.ai/blog/observability-traceability-multi-agent-ai): Agentic actions rarely stay inside one agent. Here's the difference between observability and traceability for multi-agent AI, and how to trace one task across every hop it triggers.
- [When AI Agents Go Wrong: Authentication, Data Ownership, and the Governance Gap](https://fullmakt.ai/blog/ai-agents-gone-wrong-authentication-data-ownership): A sloppy login handshake is how an AI agent ends up reading data it never should have touched. What authentication and data ownership need to look like for agentic AI — and where a credential broker fits.
- [1Password just bought into the credential broker category for AI agents](https://fullmakt.ai/blog/1password-apono-credential-broker): 1Password acquired Apono and shipped a Credential Broker for AI agents. Standing keys are over — here's why, and where brokering at issuance differs from brokering every call.
- [ISO/IEC 42001 and AI agents: what a credential broker covers for you](https://fullmakt.ai/blog/iso-42001-credential-broker): ISO/IEC 42001 asks you to govern what your AI systems do. A credential broker turns several Annex A controls into enforced policy — here's the honest mapping.
- [Fullmakt vs. Auth0: what's the difference for AI agents?](https://fullmakt.ai/blog/fullmakt-vs-auth0): Auth0 is an identity platform for users and services; Fullmakt is a credential broker for AI agents. How the two differ — and how they work together.
- [MCP and OAuth: giving agents access without giving away secrets](https://fullmakt.ai/blog/mcp-oauth-for-ai-agents): How the Model Context Protocol and OAuth 2.1 fit together to let AI agents call your tools with scoped, revocable access — and where a broker fits in.
- [Auditing every agent API call with tamper-proof logs](https://fullmakt.ai/blog/auditing-every-agent-api-call): When an AI agent acts on your behalf, you need to answer which agent did what, when, and for whom. Here's how a cryptographically chained audit log makes that answer trustworthy.
- [Scoped credentials for AI agents: least privilege by default](https://fullmakt.ai/blog/scoped-credentials-for-ai-agents): Why handing an AI agent a long-lived API key is a liability, and how short-lived, scoped credentials give agents exactly the access they need — and nothing more.

## Optional

- [Full text](https://fullmakt.ai/llms-full.txt): this map plus the complete text of every post
- [RSS feed](https://fullmakt.ai/rss.xml): new posts
- [Sitemap](https://fullmakt.ai/sitemap.xml): every indexable URL