Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio + HTTP/JSON (hosted relay, staging)
Certification scope
PASS-CONDITIONAL (hosted/staging) — Verity delta re-bench, 2026-10-27 (llm-connectors-20261027/bench-gemini.md): adapter 0.1.1 on core 0.1.2; staging conditions C1/C2/C4 CLEARED. PASS-CONDITIONAL is not CERTIFIED — certified is false, and nothing beyond this verdict at hosted/staging scope is claimed. Hosted deployment is bench-passed at hosted/staging and is NOT yet public-live. Sole surviving condition (LIVE-GATE): hosted enrolment must implement a real restriction/tier probe before any live enrolment.
What it does
- BYOK custody on the Cyan Eclipse Connect LLM core (core 0.1.2, PASS (hosted/staging)): your own provider API key is held only by the relay, encrypted (AES-256-GCM under a master key, via the core vault), under a signed, scoped, revocable grant — model allowlist, spend cap, expiry — and the agent never touches the key
- Every call is pre-checked against the grant and sealed into a content-free Herald-signed receipt; receipts are independently verifiable off-host from the published JWKS surface
- Instant kill switch: delete the key and kill every grant instantly; deleting a key cascade-revokes its grants; receipts are retained (they are content-free)
- Native Gemini API transport (generateContent) with x-goog-api-key auth injection and end-user origin forwarded on every call; thoughts tokens billed as output per Gemini's rule; price table gemini-prices/2026-10-27
- Disclosure (SPEC §11.4(i)): you remain the provider's customer and are liable for your own account activity and bills; provider token costs are billed by the provider directly to you
- Disclosure (SPEC §11.4(ii)): the relay holds your key encrypted; the key is deletable and every grant is killable instantly
- Disclosure (SPEC §11.4(iii)): content logging is OFF by default; it can be turned on only per grant by you, never by an agent, and receipts themselves contain no prompt or response content, ever
- Disclosure (SPEC §11.4(iv), Gemini): paid-tier keys only and a restricted key are required — free-tier keys and unrestricted legacy standard keys are refused at enrolment
Tools
llm_callllm_modelsllm_balancellm_receiptsllm_receipt_verify
Problems it addresses
- I need my agent to call Gemini without ever holding my Gemini API key
- I need Gemini calls bounded by a model allowlist, a spend cap, and an expiry — with a sealed receipt for every call
- My Gemini key must be a paid-tier, restricted key, held encrypted by a relay I can kill instantly
Not tested
- Any live Gemini call — bench ran against recorded fixtures/mocks only; no live provider smoke at this scope
- Public-live hosted enrolment — the LIVE-GATE condition (real hosted restriction/tier probe) is unimplemented until live enrolment opens
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →