Skip to main content
sesame onboard is the toolkit for taking an existing agent keyless behind Sesame. Its three subcommands map to the last stages of the Transparent Egress flow: understand the agent (detect), gate on protection (verify), then strip the local credential (neutralize).

​
sesame onboard detect

Read-only. Fingerprints how the agent is deployed — container entrypoint, systemd unit (system or user), or a foreground command — and reports an egress section: which providers are configured, which hosts they’ll call, whether each host is already brokered, and whether the agent still holds a real credential for it (its keyless status).
​
flag
Emit machine-readable JSON instead of the human summary.
​
string
Inspect a remote box over SSH instead of the local machine.

​
sesame onboard verify

A gate, not just a report. Checks the whole chain — the wrap is installed, sesame-proxyd is running, device identity and token are valid, and the broker answers for the agent’s hosts — and encodes the result in its exit code.
Use the exit code in scripts and CI: sesame onboard verify && <next step>. A non-zero exit means “do not proceed.”

​
sesame onboard neutralize

Takes the agent keyless by swapping its real credential for a structurally-valid dummy — a marked token with a far-future expiry. Many agents precheck for a local credential and refuse to start without one, so you can’t just delete it; the dummy keeps that precheck happy while the real credential lives only in Sesame, injected at the broker per request.
Neutralize refuses to run unless sesame onboard verify reports PROTECTED — it will never strip a credential off an un-brokered agent. Override with --force only if you know what you’re doing.
​
string
Which provider’s credential to neutralize (for example openai-codex).
​
string
Path to the agent’s credential file. Default: ~/.hermes/auth.json.
​
flag
Neutralize even if verify isn’t PROTECTED. Use with care — this can strip a credential off an agent whose egress isn’t brokered.
​
flag
Restore the real credential from the journaled backup written before the swap. Neutralize is fully reversible.
After neutralize, run sesame onboard detect again — the egress section should show the host brokered and the agent holding no real credential for it. That’s the keyless end state.