Keep tokens out
of the agent runtime.
CybrLink separates user authorization from agent execution, so your SI (super intelligence) agents can use tools without directly holding long-lived OAuth credentials.
Your SI agents need access to user apps. They do not need to hold user credentials.
- Private by design
- Use a credential layer you control instead of handing credentials to the agent runtime.
- Scoped access
- Connections are tied to users, integrations, and permissions so agents operate with explicit authorization.
- Revocation path
- Users can disconnect an app, and the system can revoke that connection instead of leaving stale access behind.
- Inspectable architecture
- CybrLink is built around auditable OAuth primitives, making the token path easier to reason about and operate.
Controls that keep provider credentials out of the agent.
These are product controls. CybrLink does not claim SOC 2, ISO 27001, or GDPR certification. No audit report is published in this repository.
Provider tokens stay in the credential host. Agents call CybrLink and do not receive raw OAuth tokens or API keys in tool results.
Each cbl_ key is limited to providers you grant. Writes are off unless you opt in, and short-lived cks_ agent sessions are read-only.
Proxied calls are logged as metadata: user, key, provider, endpoint, and status. Request and response bodies are not written to the log.
- API keys and cks_ sessions are stored as HMAC hashes and shown once
- TLS in transit; provider tokens are not stored in this app
- Append-only activity log with a per-row integrity HMAC
- Per-user connection checks before any proxied call
Architecture in one diagram
CybrLink coordinates authorization and connection state. Durable OAuth tokens stay inside the highlighted credential layer, where your team controls deployment, storage, and provider credentials.
What this page does not claim
There is no SOC 2 report, ISO 27001 certificate, or GDPR attestation in this repository. The cards above describe controls the app implements. Incident response is the published runbooks, not a trust center.
Frequently asked
Who holds the OAuth tokens?+
Your controlled credential layer is the token store. CybrLink starts and manages the connect flow, but the long-lived OAuth tokens belong in infrastructure you control.
What's the blast radius if CybrLink is compromised?+
Durable tokens live in your credential layer and do not enter the model runtime. A compromise of CybrLink's control plane does not directly expose raw durable tokens already stored in your deployment, though connected-provider access should still be revoked and audited as part of incident response.
What does self-hosted mean here?+
It means token storage and provider credentials are handled by a credential service you deploy or control. CybrLink currently supports Nango for that layer and keeps required third-party notices on the legal page.
What goes into the audit log?+
Audit entries include the user, key, action, provider key, endpoint, method, status, outcome, failure reason, timestamp, and integrity metadata where available. CybrLink records metadata only, not request or response bodies.
Can users revoke access?+
Yes. Connections are visible per user and per integration, and disconnecting an app revokes that connection instead of leaving stale access behind.