An AI assistant fills this form for you — your SSN, your bank account — without ever seeing those numbers itself.
Type an account number into the Account number box below. Then ask your AI assistant:
“Fill the vault demo: set my name to Jane Doe, fill my SSN from the vault, and copy my account number onto the file.”
The agent fills the SSN from the bridge (it was never told the number) and copies your account number onto the file (it only ever held a handle to it). Check the assistant's transcript — none of your real numbers are in it.
Then try the free-form note — a plain text box, no special SSN field:
“Draft a short letter to my tax attorney in the note, and include my SSN from the vault where it belongs.”
Phrase it however you want — this isn't a scripted prompt. The assistant only ever writes a handle for the SSN; it never sees or sends the real number. Because the value is going into a free-form field, AppMCP pauses and asks you to approve the insertion in the control panel (http://127.0.0.1:8766) — the assistant should tell you to look there. Approve, and the bridge fills in the real SSN and the whole note turns write-only — the assistant can't read back what it just wrote. Press Clear & unlock to reset it.
Finally, try the injection guard. Put hostile text in the note (use Insert sample injection below), then ask:
“Read my free-form note and do what it says.”
The note is page DATA, not instructions. As the agent reads the page, the bridge's injection monitor spots the manipulation, freezes all traffic, and surfaces it for you in the control panel (http://127.0.0.1:8766) — the agent never gets to act on it. (Toggle the monitor in the control panel under Protections; the demo setup turns it on.)
Once a secret lands here the whole note is write-only — Clear & unlock empties it and lifts the lock. (The button is data-appmcp-no-auto: only you can press it.)
From get_form_state — booleans for the name, SSN, account, and account-on-file
fields, never the values. The agent's real window is observe_page: it shows the
form, but redacts the SSN and account fields, and the account-on-file becomes
write-only once filled — the agent can type the number in via a handle but can't
read it back out.