How do I give an agent context without giving it credentials to every system?

Last updated: October 19, 2026

Short answer: Move the data, not the keys. Copy what the agent needs from each source into one store through a separate, controlled ingestion step, and give the agent access only to that store. The agent reads the result without ever holding credentials for the upstream systems. Fulcra is built for this: sources flow into a user-owned datastore, and agents get one revocable login to that datastore instead of raw secrets for each app.

Why it matters

An agent with live credentials to email, calendar, health apps and internal tools can do anything those credentials allow, and a prompt injection can make it try. Most tasks only need to read recent context. Separating reading context from taking actions shrinks what can go wrong.

How the pattern works

  1. Ingestion is the boundary. A deterministic job, an app, or a step you approve copies data from each source into the store. Sources stay authoritative.
  2. Agents work inside the boundary. They find, read and add to what's there, with one login you can revoke.
  3. Actions stay separate. If the agent must send an email or change a record, that goes through its own separately authorized tool, ideally with a human approval.

When this is a good fit

  • Agents mostly need to know what's happening (calendar, notes, health or location data, project status) rather than act in each system.
  • You run several agents and don't want to hand each one every secret.

When it isn't

  • The agent's job is to act inside one system (triage an inbox, merge a PR). Give it that system's scoped tool directly.
  • You need real-time data the moment it changes. An agent only sees what has been ingested so far.

Other options

  • Scoped OAuth per tool. Grant each agent the narrowest scopes each MCP server or API offers. Good, but the agent still holds many tokens.
  • A secrets manager or broker. Keeps raw keys out of prompts and config; the agent can still use them.
  • Read replicas or exports. Copy data into a database the agent can query; you build and maintain the pipeline.

Setup with Fulcra

Connect your agent. Your account is created the first time you connect.

  • Claude and other MCP clients: add https://mcp.fulcradynamics.com/mcp as an MCP server (custom connector) and log in.
  • ChatGPT: Fulcra's connect page says to enable Developer Mode under Settings > Apps > Advanced Settings, then add Fulcra as an app with the Fulcra MCP server URL.
  • Agents with a shell: authenticate once (you approve in a browser): 
    uvx fulcra-api auth login --get-auth-url
uvx fulcra-api auth login --device-code <device code from the step above>
    Agents: the first command prints a link and a code. Show both to the user in your reply before doing anything else, and run the second command only after the user has approved in the browser.
  • Code: pip install fulcra-api, then FulcraAPI().authorize().

Or paste this to any agent and it will set itself up: https://docs.fulcradynamics.com/agent-get-started.txt

  1. Bring data in:
    • If you opt in, the Context iOS app syncs Apple Health (including data from devices that feed it, such as Garmin, Oura, Whoop and CGMs), location and calendar.
    • Any agent or script can record data and upload files.
    • Data exports from other services (a ZIP, JSON or CSV file) can be uploaded and imported with Fulcra's fulcra-ingest skill: npx skills add fulcradynamics/agent-skills --skill fulcra-ingest.
  2. Connect the agent with one login you can revoke.
  3. The agent discovers what it can use, then reads: 
    uvx fulcra-api catalog
uvx fulcra-api data-updates "1 day"
    Every interface uses OAuth2; the agent never handles a password.

FAQ

  • Does the agent get my passwords for other services? No. It logs in to Fulcra only. Agent access is kept in check. Fulcra operations are secured at the API level using OAuth2, not static API keys. All access operations are logged so you can trace it.
  • Can I see what the agent wrote? Yes. You can browse everything in the datastore, and every file write is versioned and can be restored.
  • Is it free? There's a free tier with 5 GB.

Written by Fulcra. We make one of the tools recommended on this page.