proton-pass-mcp-local
Local MCP server to search and retrieve Proton Pass vault data via an existing pass-cli session, without storing secrets or tokens itself.
Check session connectivity with
session_status.List vaults and their
share_ids withlist_vaults.List permitted shares with
list_shares.Search or list items by title with
list_items, optionally filtering by type, state, offset, and limit.Search text notes by title/body substring with
search_notes, returning matching titles, IDs, and states without exposing note bodies.Read one requested field from a specific item with
read_field, returning the value to the connected client.Continue multi-page results using
next_cursor/cursorforsearch_notesornext_offset/offsetforlist_items.Require a specific
reasonfor sensitive operations:search_notesandread_field.Support active, trashed, or all items via the
stateparameter.Use existing Proton Pass CLI session directories and authentication; no login, token storage, or logout is performed by the MCP server.
Provides read-only access to Proton Pass, allowing users to list vaults and shares, search items by title, search text notes by content, and read individual fields using an existing pass-cli authentication session.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@proton-pass-mcp-localsearch my vault for the password to my Netflix account"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Proton Pass MCP
既存の pass-cli 認証セッションを使って、MCPクライアントからProton Passを検索するローカルMCPサーバーです。Proton公式の製品ではありません。
利用できる機能
ツール | 用途 |
| セッションの接続確認 |
| 保管庫名と共有IDの一覧 |
| 許可された共有の一覧 |
| タイトルによる検索とアイテム一覧 |
| テキストノートのタイトル・本文の部分文字列検索 |
| 理由を指定して1フィールドを取得 |
search_notes は本文を内部で照合し、一致するタイトル・ID・状態だけ返します。大文字小文字を区別します。添付ファイルは検索対象に含みません。state の既定値は active、ごみ箱込みなら all を指定します。
list_vaults で得た share_id ごとに検索します。complete: false の場合は、同じ条件に next_cursor を cursor として渡して続行し、各ページの matches を集めてください。対象一覧が途中で変わった場合は最初から検索します。本文は照合時点の値を使います。
list_items のタイトル検索は大文字小文字を区別しません。next_offset がある場合は、その値を offset に指定して続行します。
search_notes と read_field は、具体的な依頼・目的を示す reason(前後の空白を除いて5〜300文字(上限はUnicodeコードポイント数))が必要です。read_field は要求した値をツール結果へ返します。利用者が必要とするフィールドを指定してください。検索のみなら search_notes を使います。
read_field の field は空白・日本語・セクション名(例 本番.パスワード)を含む名前を指定できます。1〜100文字で、制御文字は使用できません。
Related MCP server: chist
導入
Node.js 22以降が必要です。MCPサーバーをインストールした後、明示的な setup コマンドでProton公式の pass-cli を導入できます。
npm install -g @kagayoi/proton-pass-mcp
proton-pass-mcp setupsetup はProton公式のstable manifestをHTTPSで取得し、現在のOS・CPUに対応する公式配布物をダウンロードします。manifestに記載されたSHA-256と実物が一致した場合だけ展開・配置し、復元不能時に案内する旧版バックアップを除いて一時ファイルを削除します。ログイン、PATの読み取り・保存、PATHの変更は行いません。
PASS_CLI_PATH を指定した場合、MCP起動と --force を付けない setup はその実行ファイルだけを利用します。指定先が無効でも公式の既定配置先や PATH へフォールバックせず、安全のため失敗します。省略した場合は、指定した導入先(未指定なら公式の既定配置先)、PATH の順に既存CLIを探し、見つかればダウンロードしません。stable版を公式の既定配置先へ明示的に再導入するときは、既存CLIの探索を省略する --force を使います。任意の配置先への導入を保証する場合は --force と --install-dir を併用してください。
proton-pass-mcp setup --force
proton-pass-mcp setup --force --install-dir 'D:\Tools\ProtonPass'
proton-pass-mcp setup --help公式の既定配置先は次のとおりです。
OS | 対応CPU | 配置先 |
Windows | x64 |
|
macOS | Apple Silicon / x64 |
|
Linux | arm64 / x64 |
|
対応外のOS・CPU、manifest形式の変更、危険なダウンロードURL、サイズ上限超過、SHA-256不一致では、既存のCLIを上書きせず終了します。Proton公式の配布manifestとインストーラーは Proton Pass CLI で確認できます。
CLIを認証する
setup と認証は分離されています。MCP専用のセッションディレクトリを決め、同じ環境変数を設定した状態で pass-cli login を一度実行してください。
Windows PowerShellの例:
$env:PROTON_PASS_SESSION_DIR = "$env:LOCALAPPDATA\Kagayoi\ProtonPassMcp\session"
New-Item -ItemType Directory -Force $env:PROTON_PASS_SESSION_DIR | Out-Null
& "$env:LOCALAPPDATA\Programs\ProtonPass\pass-cli.exe" login
& "$env:LOCALAPPDATA\Programs\ProtonPass\pass-cli.exe" infomacOS・Linuxの例:
export PROTON_PASS_SESSION_DIR="$HOME/.local/share/proton-pass-mcp/session"
mkdir -p "$PROTON_PASS_SESSION_DIR"
"$HOME/.local/bin/pass-cli" login
"$HOME/.local/bin/pass-cli" info既存の pass-cli を利用する場合や --install-dir を指定した場合は、その実行ファイルの絶対パスを PASS_CLI_PATH に設定します。認証方法の詳細はProton公式の Pass CLIドキュメント を参照してください。
MCPクライアントへ登録する
MCPクライアントには次のstdio設定を登録します。PASS_CLI_PATH は省略すると既定配置先または PATH から自動検出されますが、実行するCLIを固定したい場合は明示してください。Windowsでクライアントが npx を解決できない場合は、そのクライアントの手順に従って npx.cmd またはインストール済みサーバーの絶対パスを指定してください。
{
"mcpServers": {
"proton-pass": {
"command": "npx",
"args": ["--yes", "@kagayoi/proton-pass-mcp@1.0.7"],
"env": {
"PASS_CLI_PATH": "C:/Users/USER/AppData/Local/Programs/ProtonPass/pass-cli.exe",
"PROTON_PASS_SESSION_DIR": "C:/Users/USER/AppData/Local/Kagayoi/ProtonPassMcp/session"
}
}
}
}自動検出を使う場合は PASS_CLI_PATH の行を削除できます。独自のCLI配置先では、その実行ファイルの絶対パスへ変更してください。PATは設定ファイルに保存せず、既存セッションを参照します。秘密の本文やCLIの生エラーをこのサーバーがログへ保存することはありません。フィールド取得の結果は接続先クライアントに渡ります。
「有効なセッションがありません」と表示された場合は、MCPと同じ PROTON_PASS_SESSION_DIR を設定して pass-cli info で確認します。この表示だけでは期限切れ・失効・保存先の相違を特定できません。保存先が正しく認証が必要な場合は、その保存先で pass-cli login により再認証します。CLIが明示した自動ログアウトは別のメッセージで通知します。MCP自身はログアウトやトークンの保存を行いません。
setup が既存CLIを見つけられない場合は、PASS_CLI_PATH を指定しているなら、その値が正しい実行ファイルを指しているか確認します。自動検出を使うならこの変数を削除し、公式の既定配置先にファイルがあるか、現在のプロセスから PATH が見えるかを確認します。Windows ZIPの展開に失敗した場合はWindows PowerShellが利用できることと公式配布物の取得状態を確認してください。SHA-256検証に失敗した場合は検証を無効化せず、公式側のmanifestと配布物が一致してから再実行してください。
更新途中の失敗では既存ファイルを自動復元します。復元にも失敗した場合は、エラーに表示された一時バックアップを削除せず、CLIを停止してから再実行するか、バックアップ内のファイルを導入先へ戻してください。
ライセンス
このMCPサーバーは MIT License です。setup で別途導入するProton Pass CLIはProtonの GPL-3.0 License に従い、このnpmパッケージにはCLIバイナリを同梱しません。
開発・検証については CONTRIBUTING.md、システムの構造については DESIGN.md を参照してください。
Available Tools
6 toolslist_itemsARead-only
Proton Passのアイテムをタイトルで検索・一覧取得する。本文やパスワードは返さない。next_offsetがあれば続行する。
| Name | Required | Description | Default |
|---|---|---|---|
| type | No | ||
| limit | No | ||
| query | No | ||
| state | No | active | |
| offset | No | ||
| share_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, so the description goes beyond them by adding non-obvious behavior: only titles are returned, never body or passwords, and pagination continues via next_offset. This materially changes how an agent invokes and interprets results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler; the core operation is front-loaded, followed by the critical content exclusion and pagination behavior. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter read-only list tool with no output schema, the description communicates the essential semantics and pagination but omits parameter roles such as required share_id, type/state filtering, and limit usage. It is adequate for basic use but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description compensates only for the query parameter (title search) and the offset/next_offset pagination concept. It does not explain share_id, type, state, limit, or how these filters interact, leaving most of the six parameters semantically opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific operation: searching/listing Proton Pass items by title, and explicitly notes it does not return body content or passwords. This distinguishes it from siblings like search_notes and read_field, so an agent can differentiate without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the intended use case: title-based searching/list retrieval while excluding sensitive content, which helps an agent decide against using body/password tools. It does not explicitly name alternatives or state when not to use it, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_vaultsARead-only
Proton Passのアクセス可能な保管庫一覧。share_idを他のツールへ渡す。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as readOnly and non-destructive, and the description adds that only accessible vaults are returned and that share_id is a key output. It does not describe response shape or possible pagination, but the added context is reasonable for a read-only list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short clauses with no filler; the first states the operation and scope, the second states the integration purpose. It is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, read-only list tool, the description covers the core resource and identifies the important output field, share_id, that other tools need. There is no output schema, so a bit more detail on returned fields would help, but this is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero input parameters and an empty schema, so there is nothing for the description to explain about parameter meaning. The schema coverage is complete by default, and the 0-parameter case correctly gets a baseline score of 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Proton Passのアクセス可能な保管庫一覧', a clear list operation on a specific resource scoped to accessible vaults. The second sentence notes that share_id is meant for other tools, which adds context, though it does not explicitly distinguish this from the sibling list_shares.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used to obtain a share_id to pass to other tools, giving useful context. However, it does not explicitly state when to prefer this over list_shares or other siblings, leaving some routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fieldARead-only
ユーザーが取得を求めたProton Passの指定フィールド1つを取得する。値がツール結果に含まれるため、秘密値を必要とする明示依頼で使用する。検索はsearch_notesを使う。
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | pass-cliのフィールド名。空白・日本語・セクション名を含めて指定可能。 | |
| reason | Yes | アクセスが必要な具体的なユーザー依頼・目的(最大300文字) | |
| item_id | Yes | ||
| share_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
annotations(readOnlyHint: true, openWorldHint: true, destructiveHint: false)があり、安全な読み取り操作であることは既に示されている。descriptionはそれに加えて、取得した値がツール結果に含まれること、秘密値が含まれること、使用条件を開示しており、追加の行動的コンテキストを提供している。annotationsと矛盾はない。4点が妥当。
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
2文で構成され、各文が重要な情報を含む。最初の文でツールの目的と秘密値の扱いを明確にし、2文目で検索ツールとの使い分けを簡潔に指示。情報が過不足なくコンパクトにまとまっており、重要な内容が先頭に配置されている。
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
このツールは単一フィールドの取得という単純な操作で、annotationsが安全性を網羅し、output_schemaがないため戻り値の形式は重要だが説明がない。しかし、取得するフィールド名とIDの4パラメータがすべて必須で、reasonフィールドの目的もschemaで説明されており、descriptionで述べられている使用条件(検索はsearch_notes)も含め、エージェントが正しく呼び出すための主要な情報は揃っている。わずかな欠落(戻り値の詳細)を考慮して4が適切。
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
schema_description_coverageは50%で、fieldとreasonの説明がschemaにあるが、item_idとshare_idは説明がない。descriptionはfieldが「pass-cliのフィールド名」であることを補足しているが、item_idとshare_idの意味は説明されておらず、schemaの説明に依存している。schemaが半分のパラメータを既に説明しているので、baselineの3が適切で、descriptionが大幅に補足しているわけではない。
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
明確に1つのProton Passフィールドを取得することを述べ、検索ツール(search_notes)と区別している。秘密値を含む明示的な依頼に使うという具体的な使用文脈も示されており、ツールの目的が明確に伝わる。
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
descriptionは「検索はsearch_notesを使う」と明示的に代替ツールを指定し、取得と検索の使い分けを示している。また「ユーザーが取得を求めた」「秘密値を必要とする明示的な依頼」という使用条件を述べており、いつ使うべきかが明確で、排他的なガイドラインもある。
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_notesARead-only
Proton Passのテキストノートをタイトル・本文の完全な部分文字列で検索する(Keeperからインポート等)。本文は返さず一致タイトル・ID・状態を返す。1回3件ずつ照合する。complete=falseなら同じ条件とnext_cursorで続行し、全ページのmatchesを集める。保管庫ごとに実行。
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| state | No | active | |
| cursor | No | ||
| reason | Yes | アクセスが必要な具体的なユーザー依頼・目的(最大300文字) | |
| share_id | Yes | ||
| page_size | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the read-only/non-destructive annotations, the description discloses meaningful behavior: it does not return body text, matches 3 items at a time, and requires continuing with next_cursor when complete=false to collect all matches. It also adds the per-vault execution detail, exceeding what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is composed of five compact sentences, each carrying distinct information: search scope, output omission, batch size, pagination contract, and per-vault requirement. There is no filler or redundant repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description adequately covers the returned fields (title, ID, status) and the pagination mechanism needed to gather all results. It stops short of detailing the exact JSON response shape or potential error cases, but the core invocation essentials are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 17%, so the description must compensate. It clarifies that query searches title and body substrings, page_size is effectively 3 per call, cursor is used to continue pagination, and share_id maps to per-vault execution. Although state and reason are not explicitly explained in the description, their meaning is already present in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches Proton Pass text notes by exact substring in title and body, and explicitly lists what it returns (matching title, ID, status). It is specific and resource-bound, but it does not explicitly differentiate this from sibling tools like list_items or read_field.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives useful contextual hints such as 'Keeper import' and instructs to execute per vault. However, it does not state when to prefer this tool over siblings like list_items or read_field, nor does it provide exclusions or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_statusBRead-only
Proton Pass pass-cliの既存認証セッションを確認する。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint=true and destructiveHint=false, so it is clear this is a safe, read-only operation. The description adds no further behavioral context beyond that, such as what status information is returned or how authentication state is determined. It does not contradict annotations; it's just sparse given the annotations do heavy lifting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single clear sentence in Japanese, front-loaded and concise. It earns its place by stating both product (Proton Pass) and context (pass-cli). No extra words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only status tool with clear annotations, the purpose description is largely complete. A minor gap is not describing what the status output looks like, but with no output schema and a merely intended 'check', the core is covered. Since it uses a Japanese sentence and no usage guidance, a complete score would demand slightly more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100%, so there is no parameter burden. The description's role is only to clarify purpose, which it does. Baseline 4 is appropriate for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Proton Pass pass-cliの既存認証セッションを確認する' states a specific verb (確認/check) and resource (existing authentication session) for the Proton Pass CLI. It distinguishes this tool from the sibling tools, which all deal with vaults, shares, items, notes, and fields—none of which indicate session handling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool vs the alternatives. It doesn't mention whether this should be called before listing vaults or performing other operations, and it doesn't name any excluded scenarios or alternative tools. The context is implied only through the verb and resource.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.2- First observed
list_items - First observed
list_shares - First observed
list_vaults - First observed
read_field - First observed
search_notes - First observed
session_status
TDQS
Scored across 6 tools
Most tools have clearly distinct purposes: session_status, list_vaults, list_items, search_notes, and read_field are each focused on different operations. The main ambiguity is between list_vaults and list_shares, which both describe listing access-related containers and could be confused without deeper context.
The tool names mostly follow a clear verb_noun pattern: list_vaults, list_shares, list_items, search_notes, read_field. session_status breaks this pattern and would be more consistent as get_session_status or check_session, making this a minor but noticeable deviation.
Six tools is a well-scoped set for a read-only Proton Pass retrieval server. Each tool covers a distinct operation without unnecessary duplication, and the count is squarely in the ideal range for agent usability.
The tool surface covers session checks, vault/share discovery, item and note listing, note search, and explicit single-field secret retrieval, which is coherent for its apparent read-only purpose. Minor gaps exist, such as no multi-field item read or write operations, but these are workable limitations rather than dead ends.
Maintenance
Related MCP Connectors
Read-only MCP access to authorized Vocci sessions, notes, files, and memory search.
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Search your Glasp web and Kindle highlights, notes, and AI memories from any MCP client. Read-only.
Search your newsletter and YouTube archive, drafted actions and working context from any MCP client.
Related MCP Servers
- AlicenseAqualityDmaintenanceProvides read-only access to an Obsidian vault, enabling file listing, content reading, and text search across notes via MCP.42Apache 2.0
- AlicenseNot gradedqualityBmaintenanceMCP server for unified full-text search across chat histories from Claude Code, Codex, Cursor CLI, and Antigravity CLI, using SQLite FTS5. Provides read-only tools to search sessions, list conversations, and retrieve session details.MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to interact with Proton Mail through a self-hosted server that works alongside Proton Mail Bridge. It provides read-only mailbox tools such as listing folders, searching mail, and retrieving messages while keeping Bridge isolated from the network.MIT
- AlicenseAqualityBmaintenanceEnables MCP-compatible agents to query structured penetration testing engagement state captured from tmux sessions, including credentials, hosts, and command provenance with exact source bytes.15MIT