Start with a bounded development task
An API integration often needs both code changes and a credentialed request. Phantom separates those concerns: managed dotenv values move into a local vault, while supported HTTP requests use an authenticated local proxy. Begin with a non-production integration and a task you can verify locally.
1. Protect the project before opening the agent
Install a reviewed release using the installation guide. Keep an independent recovery copy of each credential in the provider console or an approved password manager. From a terminal you control, initialize the intended project, then inspect names and protection state. Initialization changes the managed dotenv file and does not leave a plaintext project backup.
phantom init
phantom list
phantom check2. Give the agent a narrow task contract
Name the repository, objective, permitted files, secret names and required tests. A useful first task is adding a provider client behind an existing interface and testing it against a local stub. State separately whether any live request is allowed. Local readiness does not authorize deployment, provider changes or billing actions.
For missing credentials, ask the operator to use phantom add NAME in a trusted terminal. Never put the value in chat or tool arguments. The MCP interactive-add tool returns this command; it does not receive or store the value.
3. Launch the supported client through the proxy
Inspect local readiness before launching your client. The example below uses Codex; the client guides also describe Claude Code, Cursor and Windsurf. Phantom configures implemented SDK base-URL overrides for the child. Exact matched routes inject their own credential into a fixed authentication header; client headers and bodies do not select vault values.
phantom agent doctor
phantom exec -- codex4. Close the task with evidence
Review the diff and run the repository's focused tests. Check agent output, patches and logs for credential disclosure without copying protected mappings into a report. Record local tests separately from any authorized provider request. After the proxy stops, its old session authorization is invalid.
phantom check
git diff --check
git status --shortDecide whether this boundary fits
Phantom is not a process sandbox and does not make an untrusted same-user process safe. Unsupported protocols are not silently protected: database drivers do not use the HTTP proxy, and protected database URLs are not restored into the child environment. Existing disclosures in history or unrelated files still need separate remediation.