Skip to navigation
ReferencePassport pluginWork with your agent

Set up an evaluation proxy with the Passport plugin

Use the passport-setup skill to set up and verify a Passport Proxy for evaluation, locally in Docker or on a single Amazon Web Services (AWS) instance. The skill proves the end-to-end flow so you can see how Passport works before you run it in production.

This setup is for evaluating Passport, not for production. The proxy uses an in-memory development vault, so restarting it clears any stored secrets. To deploy a production proxy backed by a durable secret store, see Deploy the Passport Proxy.

Prerequisites

Before you run the skill, make sure you have the following:

  • A registry credential for your Passport team. A Passport Admin generates it under the Registry tab in the Passport app.
  • Either Docker, to run the proxy locally, or an AWS account with a configured command-line interface (CLI) profile, to run it on AWS. The skill supports only these two targets.
  • The openssl, curl, jq, and node command-line tools.

What the skill can do

To get started, enter the following prompt in your agent:

setup passport

The agent asks whether to run the proxy locally in Docker or on AWS. The target you choose determines where the proxy runs and what the agent creates:

  • Local Docker — Runs the Passport Proxy and a HashiCorp Vault as two containers on your machine. The Vault is an in-memory development instance that holds the test secrets for your evaluation.
  • AWS — Runs those same two containers on a single EC2 instance, with Amazon CloudFront providing a trusted HTTPS address for the proxy’s management port.

The AWS setup creates billable resources in your AWS account.

For either target, the agent also sets up the Passport CLI, registers the proxy with Passport Cloud, and creates a namespace connected to it.

By the end, the agent runs an end-to-end test. A client calls an API with only a secret reference in place of a real key, and the proxy injects the real secret. The agent then offers to register your own API so you can try the same flow against a service you use.

Throughout setup, the agent confirms every cloud change before it makes it, never takes a secret value into the conversation, and tears nothing down until you tell it to.