mkeys
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| MKEYS_HOME | No | Data directory, default ~/.mkeys | ~/.mkeys |
| MKEYS_DEBUG | No | Output debug logs to stderr | |
| MKEYS_MASTER_KEY | No | Master key: base64 of 32 bytes, or any passphrase (scrypt derived). If not set, auto-generates ~/.mkeys/master.key on first start | |
| MKEYS_ADMIN_TOKEN | No | Web admin console access token (default reads/generates ~/.mkeys/admin.token) | |
| MKEYS_ALLOW_REVEAL | No | Whether to allow reveal_secret to read raw secrets (default false). Can also be set via plugin setting allowReveal | false |
| MKEYS_ALLOW_PRIVATE_ENDPOINTS | No | Allow verify/token endpoints to point to loopback/private/reserved addresses (default false). Only enable in trusted intranet environments. Can also be set via plugin setting allowPrivateEndpoints | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_credentialsA | 列出凭据库中所有凭据的元数据（名称、系统、类型、字段名、端点配置）。不返回任何密钥明文。在 add/get_token 之前先调用它确认凭据名称。 |
| add_credentialA | 添加一个系统凭据（名称唯一）。敏感字段值支持 'env:VAR_NAME' 形式——写入时从服务进程环境变量读取实际值，推荐这种方式以避免密钥经过对话内容。所有字段以 AES-256-GCM 加密后落盘。 |
| update_credentialA | 更新已有凭据。fields 只合并传入的键；removeFields 删除字段；endpoints 整体替换。同样支持 'env:VAR' 间接引用。 |
| delete_credentialA | 删除一个凭据（不可恢复）。删除前会返回该凭据的使用统计摘要。 |
| verify_loginA | 验证凭据登录是否有效（2xx=有效，401/403=被拒绝）。优先使用配置的 verify 端点，否则以能否成功签发令牌为准。验证结果计入使用统计。 |
| get_tokenA | 为指定凭据签发（或复用缓存的）临时令牌供后续调用使用。必须在 purpose 中说明本次用途，便于审计统计。返回令牌值、携带方式（请求头）、有效期。令牌仅缓存在内存中，过期自动重新签发。 |
| reveal_secretA | 读取凭据的原始密钥明文（危险操作，每次调用都计入审计日志）。默认禁用——需要用户在插件设置中开启 allowReveal。优先使用 get_token 获取临时令牌而非读取原始密钥。 |
| open_adminA | 启动（或复用）mkeys 本地 Web 管理台并返回带一次性访问令牌的访问地址（仅绑定 127.0.0.1）。页面上可以图形化管理凭据（增删改查、表单添加）、在线验证登录、签发临时令牌、查看使用统计图表。用户说'打开/看 mkeys 管理页面'或需要图形界面管理凭据时调用。 |
| usage_statsA | 查询 AI 使用统计：按凭据、按用途、按天的调用量与成功率，以及最近失败记录。用户询问'密钥用了多少次/用在哪/用来干什么'时调用本工具。 |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool maps to a distinct action: CRUD on credentials, login verification, token issuance, raw secret reveal, admin UI, and usage stats. Potentially similar tools like get_token and reveal_secret are clearly separated by temporary token vs raw secret.
Most names follow a verb_noun snake_case pattern (add_credential, get_token, reveal_secret). Minor deviations include list_credentials using a plural noun while its CRUD siblings are singular, and usage_stats lacking a leading verb.
Nine tools is well-scoped for a credential manager, covering CRUD, validation, token issuance, secret access, an admin UI, and usage monitoring. There is no redundant or excessive surface.
The set provides complete lifecycle coverage: add/read/update/delete credentials, verify logins, obtain tokens, reveal raw secrets, manage via admin UI, and audit usage. No obvious dead ends or critical missing operations exist for this domain.