Clavis MCP Server

Secure credential management for Claude Desktop and MCP servers.

Features

• 🔐 Encrypted credential storage (AES-128-CBC + HMAC-SHA256, via Fernet)

• 🛡️ Server-side credential injection — the raw key never enters the conversation

• 🔄 Automatic OAuth token refresh

• 📡 Thin forwarding layer — rate limiting, audit logging, and usage tracking are all handled by the Clavis server

Related MCP server: GhostKey

Installation

npx @clavisagent/mcp-server

Or install globally:

npm install -g @clavisagent/mcp-server

Usage with Claude Desktop

Add the following to your Claude Desktop configuration file (claude_desktop_config.json):

{
  "mcpServers": {
    "clavis": {
      "command": "npx",
      "args": ["-y", "@clavisagent/mcp-server"],
      "env": {
        "CLAVIS_API_KEY": "eyJ..."
      }
    }
  }
}

Usage with Claude Code

claude mcp add clavis -- npx -y @clavisagent/mcp-server

Configuration

Available Tools

Security note

Prefer call_service over get_credentials. call_service keeps the secret server-side, so a prompt injection has no credential in context to exfiltrate. get_credentials places the raw key in the conversation and exists only for callers that must hold the token themselves.

License

MIT