Credential Isolation for AI Agents, first in file transfer clients (March 2026)

[axpnet]

The problem

AI coding agents increasingly need to transfer files to remote servers - deploying websites, syncing build folders, downloading logs. Every such operation requires authentication.

In current workflows, the agent must receive credentials directly: via environment variables, command arguments, configuration files it can read, or URLs with embedded passwords. The authentication material is exposed to the agent process and may appear in conversation history, logs, or error messages.

We looked at every file transfer tool available today. None provides a credential isolation boundary between the tool and the calling process:

• Multi-cloud CLIs store passwords with reversible encoding or static keys
• FTP/SFTP clients use plaintext XML or OS keystores accessible to any same-user process
• S3 utilities store credentials in plaintext ~/.aws/credentials
• IDE deployment extensions put passwords in readable workspace files (.vscode/sftp.json)
• Credential proxy services only support HTTP APIs - they cannot handle FTP, SFTP, or WebDAV

How AeroFTP solves this

Starting with v2.9.9, the CLI --profile flag and AeroAgent server_exec tool resolve credentials exclusively inside the Rust backend process, from an AES-256-GCM encrypted vault derived with Argon2id.

# List saved servers (never shows credentials)
aeroftp-cli profiles

# Connect using a saved profile - zero credentials exposed
aeroftp-cli ls --profile "Production" /var/www/
aeroftp-cli put --profile "Staging" ./dist/app.js /var/www/app.js
aeroftp-cli sync --profile "NAS Backup" ./data/ /backups/ --dry-run

# OAuth providers authorize via browser on first use
aeroftp-cli ls --profile "Google Drive" /

The credential material never appears in:

• Command-line arguments (/proc/*/cmdline)
• Environment variables
• Shell history
• IPC messages between backend and frontend
• AI model context or conversation history
• Log output or error messages

This works across all 22 supported protocols: FTP, FTPS, SFTP, WebDAV, S3, Google Drive, Dropbox, OneDrive, MEGA, Box, pCloud, Azure Blob, Filen, Internxt, kDrive, Koofr, Jottacloud, FileLu, Zoho WorkDrive, Yandex Disk, OpenDrive.

Practical use

A developer using Claude Code, Cursor, or any AI coding agent can give the agent full operational access to their servers while maintaining a strict credential boundary:

# AI agent deploys - no password anywhere
aeroftp-cli put --profile "Production" ./dist/ /var/www/ -r

# CI/CD - single vault secret unlocks all servers
AEROFTP_MASTER_PASSWORD=$SECRET aeroftp-cli sync --profile "Deploy" ./build/ /www/

Implementation

The architecture is fully auditable:

Component	Source
Encrypted vault	credential_store.rs
CLI --profile	aeroftp_cli.rs
AeroAgent tools	ai_tools.rs
OAuth2 manager	oauth2.rs

Full analysis: docs/CREDENTIAL-ISOLATION.md

Reviewed by 10 independent auditors (5 Claude Opus 4.6 + 5 GPT 5.4) - 83+ findings identified and resolved.

---

AeroFTP is open source (GPL-3.0). If you work with AI agents and remote servers, feedback is welcome.