Secure credential management for Claude Desktop and MCP servers.
🔐 Encrypted credential storage (AES-128-CBC + HMAC-SHA256, via Fernet)
🛡️ Server-side credential injection — the raw key never enters the conversation
🔄 Automatic OAuth token refresh
📡 Thin forwarding layer — rate limiting, audit logging, and usage tracking are all handled by the Clavis server
Related MCP server: GhostKey
npx @clavisagent/mcp-serverOr install globally:
npm install -g @clavisagent/mcp-serverAdd the following to your Claude Desktop configuration file (claude_desktop_config.json):
{
"mcpServers": {
"clavis": {
"command": "npx",
"args": ["-y", "@clavisagent/mcp-server"],
"env": {
"CLAVIS_API_KEY": "eyJ..."
}
}
}
}claude mcp add clavis -- npx -y @clavisagent/mcp-serverVariable | Required | Default | Description |
| yes | — | Your Clavis JWT, from |
| no |
| Base URL of your Clavis instance. Set this for self-hosted deployments. |
Tool | Description |
| Recommended. Make an API call with server-side credential injection — the credential is injected into the upstream request server-side, so the raw key never enters the conversation. |
| Legacy. Returns the raw access token or API key for a named service. Prefer |
| List all services with stored credentials |
| Check the status and expiry of credentials for a service |
Prefer call_service over get_credentials. call_service keeps the secret
server-side, so a prompt injection has no credential in context to exfiltrate.
get_credentials places the raw key in the conversation and exists only for
callers that must hold the token themselves.
MIT
RECOMMENDED: Make an API call with server-side credential injection. The credential is fetched from the Clavis vault and injected into the upstream request server-side — the raw API key never enters this conversation. Prefer this over get_credentials: it eliminates prompt-injection exfiltration as an attack vector, because there is no secret in context to exfiltrate.
Inputs: url (required), method (required), service_name (required), data, +3 more.
Check the validity and rate-limit status of credentials for a service without making any external API call. Queries only the Clavis vault (database + Redis). Returns validity, expiry, rate-limit headroom, and last-used timestamp.
Inputs: service_name (required).
LEGACY — returns raw credential data into this conversation. Prefer call_service for security: call_service injects credentials server-side so the raw API key is never exposed to the model. Use this only when you must hold the token itself (e.g. handing it to a library that cannot be proxied). Clavis handles token refresh and rotation automatically.
Inputs: service_name (required).
List all services configured in Clavis for the authenticated developer.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 4 tools
Each tool has a clearly distinct purpose: call_service proxies requests with server-side credential injection, get_credentials returns raw tokens for non-proxy use, list_services enumerates configured services, and check_credential_status inspects vault state without external calls. The overlap between call_service and get_credentials is explicitly addressed with usage guidance, so an agent can select correctly.
All tool names follow a consistent verb_noun pattern in lower_snake_case: call_service, get_credentials, list_services, check_credential_status. The verbs are distinct and clearly map to each tool's function.
With four tools, the set is tightly focused on core Clavis operations: using credentials, retrieving them, listing services, and checking status. This is the right granularity for a credential-management server—not bloated, not thin.
The tool surface covers the full lifecycle of interacting with Clavis-managed credentials: calling an upstream service, retrieving a raw credential when necessary, discovering available services, and checking status/rate limits. Missing features like credential creation or rotation are handled automatically by Clavis, so these are not gaps for the agent.
Credential broker for AI agents: scoped, revocable API access with policy enforcement and audit.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
One MCP endpoint for Claude, GPT & Gemini: 100+ tools + no-code connectors + agent workers.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.