Secrets Management
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
Secrets Management in the DeepCode project refers to the systematic handling, storage, and retrieval of sensitive configuration data, primarily API keys required for Large Language Model (LLM) providers and external services. This system ensures that the core logic of the application remains decoupled from specific credentials, allowing for secure and flexible deployment across different environments.
The project utilizes a centralized configuration approach where sensitive data is stored in dedicated YAML files. These secrets are consumed by various workflow managers and agents to authenticate requests to providers like Anthropic and OpenAI, enabling the core functionalities of the Code Implementation Workflow and specialized agents.
Sources: workflows/code_implementation_workflow.py:30, workflows/code_implementation_workflow_index.py:32
Architecture and Configuration
The secrets management system is built around a YAML-based configuration file, typically named mcp_agent.secrets.yaml. This file serves as the single source of truth for the application's sensitive parameters.
Configuration Structure
The project expects a structured YAML format to organize credentials by provider. This organization allows the system to verify the availability of specific keys before attempting to initialize corresponding service clients.
| Provider | Key Field | Description |
|---|---|---|
| Anthropic | api_key | Authentication key for Claude models. |
| OpenAI | api_key | Authentication key for GPT models. |
| OpenAI | base_url | Optional custom endpoint URL for OpenAI-compatible services. |
Sources: workflows/code_implementation_workflow.py:270-280, workflows/code_implementation_workflow_index.py:284-290
Data Flow for Secret Retrieval
The following diagram illustrates how secrets are loaded from the filesystem and injected into the LLM clients during the workflow initialization process.
The workflow classes load the YAML configuration into a dictionary (self.api_config) during the __init__ phase.
Sources: workflows/code_implementation_workflow.py:53-61, workflows/code_implementation_workflow_index.py:55-63
Secure Client Initialization
The _initialize_llm_client method acts as a gatekeeper and factory for service clients. It performs validation checks on the secrets loaded from the configuration file to determine which LLM provider can be used.
Initialization Logic
- Key Detection: The system checks
self.api_configfor the presence of keys under theanthropicoropenaiblocks. - Prioritization: It typically attempts to initialize the Anthropic client first if a key is available.
- Fallback: If the Anthropic key is missing or the connection test fails, it falls back to the OpenAI configuration.
- Validation: Before returning a client, the system performs a "test connection" by sending a minimal token request to ensure the provided secret is valid.
Sources: workflows/code_implementation_workflow.py:265-310, workflows/code_implementation_workflow_index.py:280-325
Secrets in Agent Memory and Workflows
Secrets are passed downstream to specialized agents. For example, the ConciseMemoryAgent uses provider-specific client types to determine which summarization logic to apply, though the secrets themselves are typically encapsulated within the client objects provided to it.
Workflow Integration
The workflow managers (CodeImplementationWorkflow and CodeImplementationWorkflowWithIndex) maintain the secrets in their internal state and use them to attach LLMs to agents via the mcp_agent framework.
- Config Path: Defaults to
mcp_agent.secrets.yaml. - API Config: A dictionary containing the parsed YAML content.
- Agent Attachment: Uses
get_preferred_llm_class(self.config_path)to ensure agents use the correct credentials for their tool-calling capabilities.
Sources: workflows/code_implementation_workflow.py:47-51, workflows/code_implementation_workflow_index.py:155-157, workflows/agents/memory_agent_concise.py:84-88
Conclusion
Secrets Management in DeepCode is a centralized, YAML-based system that prioritizes security through connection validation and provider abstraction. By isolating credentials like OpenAI and Anthropic API keys in mcp_agent.secrets.yaml, the architecture ensures that the multi-agent workflows can dynamically switch between LLM providers while maintaining a secure posture.
Sources: workflows/code_implementation_workflow.py:53-61, workflows/code_implementation_workflow_index.py:280-285