This MCP server lets AI agents manage and use encrypted secrets while keeping plaintext out of the conversation transcript.
Resolve a secret by name at runtime through the configured backend, returning the decrypted value for the operation.
Store a secret in the AES-256-GCM encrypted vault.
List stored secret names only, without revealing values.
Replace real .env values with deterministic fake values via sandboxing.
Restore real .env values from the vault via unsandboxing.
Delete a secret from the vault.
View an audit log of secret resolutions, stores, and deletes, optionally limited by entry count.
Encrypted secrets vault with MCP for AI agents. One command configures every editor. Secrets resolved at runtime, never leaked to LLM conversations.
Developers regularly leak API keys, passwords, and tokens to AI coding tools. 100,000+ LLM conversations with exposed secrets were found indexed by search engines in 2025.
AI agents read your .env files. They copy-paste secrets into conversations. They commit them accidentally. Keyblind stops this by keeping secrets encrypted at rest and resolving them at runtime — the plaintext value never touches the LLM transcript.
Related MCP server: enigmagent-mcp
┌──────────┐ ┌────────────────┐ ┌─────────────────┐
│ AI Agent │ ──→ │ Keyblind MCP │ ──→ │ Encrypted │
│ (Claude) │ │ Server │ │ SQLite Vault │
│ │ ←── │ (27 tools) │ ←── │ (AES-256-GCM) │
└──────────┘ └────────────────┘ └─────────────────┘
↑ │
│ secret value never appears │ secrets never
│ in conversation transcript │ stored in plaintext# 1. Install
npm i -g keyblind
# 2. One-command setup (initialize vault + configure Claude Code)
keyblind quickstart
# 3. Store secrets
echo "sk-proj-abc123" | keyblind set OPENAI_API_KEY
keyblind set DATABASE_URL - # prompts securely
# 4. Sandbox your .env (AI agents see fakes)
keyblind sandbox
# 5. Resolve a secret
keyblind get OPENAI_API_KEY
# 6. Run commands with secrets injected as env vars
keyblind run -- npm start
# 7. List all secrets (names only, values hidden)
keyblind listThat's it. After
keyblind quickstart, restart Claude Code. Then just say "list my keyblind secrets" or "use my OPENAI_API_KEY" — the AI agent resolves secrets at runtime without ever seeing them in the transcript.
Keyblind is MCP-first — it works with every AI tool that speaks the Model Context Protocol (Claude Code, Cursor, Copilot, Windsurf, Cline, Zed).
keyblind setup-mcpThis auto-configures Claude Code, Cline, and Zed to use Keyblind. Works from any directory.
For project-local editors (Cursor, Windsurf, Copilot, Cline project mode), run from your project root:
keyblind setup-mcp --localSee editor-specific configs for details and manual setup.
Add a .mcp.json to your project root, or use claude mcp add:
claude mcp add --scope user keyblind -- keyblind startWith biometric gate (Touch ID required before secrets are resolved):
keyblind unlock # Authenticate first
claude mcp add keyblind -- keyblind start --biometricSession expires after 15 minutes. Requires Pro or Team license.
Tool | Description |
| Resolve a secret at runtime (value hidden from transcript) |
| Encrypt and store a secret |
| List secret names (values never revealed) |
| Delete a secret |
| Replace |
| Restore real |
| View secret resolution audit trail |
| Generate a TOTP 2FA code for a stored config |
| Store a TOTP configuration from otpauth:// URI |
| List all stored TOTP configurations |
| Delete a TOTP configuration |
| Create encrypted, expiring share link for a secret |
| Receive and decrypt a shared secret |
| Check dead man's switch status |
| Reset dead man's switch timer |
| Create a shared team vault (encrypted SQLite) |
| Push a local secret to the team vault |
| Import all secrets from the team vault |
| List secret names in the team vault |
| Resolve (decrypt) a secret from the team vault |
| Delete a secret from the team vault |
| Check SSO/OIDC authentication status |
| Register an AI agent bound to a human sponsor |
| Append a signed action to the tamper-proof ledger |
| Verify ledger integrity (hash chain + signatures) |
| List registered AI agents |
| Export the agent ledger as a compliance report |
Manage your secrets from a browser — no sign-in or pairing required. Open the local dashboard:
keyblind dashboardThis starts the local server and opens http://localhost:4318/ in your browser. The dashboard is served same-origin with the REST API, so it works in every browser with no CORS, no pairing token, and no login. Features:
View, add, copy, and delete secrets
Audit log with full access history
License management (tier, email, expiry)
Pro/Team tier status
Per-secret access policies and rotation reminders
Agent action approvals (approve/deny queued agent writes)
Central control plane (org-wide visibility + signed revocation)
A hosted control plane (hosted/) adds orgs, roles, groups, a signed
revocation + group-scope manifest, multi-provider SSO login (with org
auto-provisioning, multi-org switching, and IdP end-session revocation), and
short-lived agent credentials. See docs/enterprise.md (Phase 2).
The Keyblind Chrome Extension detects and blocks secrets from being pasted into AI chat interfaces (Claude.ai, ChatGPT, Copilot).
Features:
Detects 12+ API key formats (OpenAI, GitHub, Stripe, AWS, etc.)
Intercepts paste events on AI chat sites
Warning banner when secrets are detected
Popup with vault connection status
Located in browser-extension/. Load as unpacked extension from chrome://extensions.
Free | Pro | Team | |
Price | $0 | $79/year | $29/user/month |
Secrets | 5 | Unlimited | Unlimited |
Local vault | ✓ | ✓ | ✓ |
Sandbox / Unsandbox | ✓ | ✓ | ✓ |
MCP server | ✓ | ✓ | ✓ |
Dashboard | ✓ | ✓ | ✓ |
Browser extension | ✓ | ✓ | ✓ |
7 backends | ✓ | ✓ | ✓ |
Team vaults | — | ✓ | ✓ |
Audit log | — | ✓ | ✓ |
Secret sharing | — | ✓ | ✓ |
Dead man's switch | — | ✓ | ✓ |
TOTP 2FA | — | ✓ | ✓ |
Biometric gate | — | ✓ | ✓ |
SSO/OIDC | — | — | ✓ |
CI/CD integration | — | ✓ | ✓ |
# Buy a license at keyblind.dev, then activate:
keyblind activate <your-license-key>
# Check your status
keyblind statusKeyblind supports multiple secret backends:
keyblind backends # List available backends
keyblind backend 1password # Switch to 1Password
keyblind backend bitwarden # Switch to BitwardenBackend | Read | Write | Requires |
local (default) | ✓ | ✓ | Nothing |
1password | ✓ | ✓ |
|
bitwarden | ✓ | — |
|
env | ✓ | — | Nothing |
aws | ✓ | ✓ |
|
gcp | ✓ | ✓ |
|
azure | ✓ | ✓ |
|
Keyblind | Cloak | |
Protocol | MCP (all editors) | VS Code extension only |
Editors | Claude Code, Cursor, Copilot, Windsurf, Cline, Zed | VS Code, Cursor |
Storage | AES-256-GCM SQLite | AES-256-GCM file |
Backends | Local, 1Password, Bitwarden, Env, AWS, GCP, Azure | Local only |
Sandbox | Deterministic HMAC fakes | AES-256-GCM encrypted |
Web dashboard | ✓ (localhost:4318) | — |
Browser extension | ✓ (Chrome) | — |
TOTP 2FA | ✓ | — |
Secret sharing | ✓ (encrypted URL fragment) | — |
Dead man's switch | ✓ | — |
Touch ID | ✓ (macOS biometric gate) | ✓ |
CI/CD |
| — |
Network | Zero (fully local) | Zero |
License | MIT | Proprietary |
Free tier | ✓ (5 secrets) | ✓ |
Pro | $79/year (unlimited) | — |
AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
Machine-identity-bound key — encryption key XOR-wrapped with machine fingerprint
Zero network, zero telemetry — no cloud, no accounts, no analytics
Vault stored at ~/.keyblind/ with 0700 permissions
Deterministic sandbox fakes using HMAC-SHA256 per project + key name
Releases are built and published from GitHub Actions with npm provenance, which attests the tarball was produced from this repository's CI rather than a developer machine.
npm audit signatures # Verify npm registry signaturesTo verify build provenance for a release, open the release page at https://github.com/aarifmms/keyblind/releases and check the "Provenance" and "Attestations" sections, which link the tarball to the exact commit and workflow run that built it.
Small dependency graph — the CLI depends on three packages only (MCP SDK,
better-sqlite3, zod). Server-only deps (Stripe, Resend, the Vercel CLI) live in
the hosted/ and dashboard/ packages and are not installed by
npm i -g keyblind.
No source maps — the published tarball ships compiled JavaScript with no embedded original source.
keyblind quickstart One-command setup (init + configure Claude Code)
keyblind init Initialize the encrypted vault
keyblind set <name> Store a secret (value from stdin)
keyblind set <name> - Store a secret (prompts securely)
keyblind get <name> Resolve and print a secret
keyblind list List all stored secrets
keyblind delete <name> Delete a secret
keyblind setup-mcp Auto-configure MCP for Claude Code, Cline, Zed
keyblind setup-mcp --local Write project MCP configs (Cursor, Windsurf, Copilot, Cline)
keyblind sandbox [.env] Replace .env with deterministic fakes
keyblind unsandbox [.env] Restore real .env values
keyblind run <command...> Run command with secrets as env vars
keyblind start Start MCP server (stdio — for AI agents)
keyblind start --http Start HTTP server (dashboard + MCP + REST API)
keyblind dashboard Open the web dashboard in your browser
keyblind start --biometric Start MCP server with biometric requirement
keyblind backends List available backends
keyblind backend <name> Switch backend
keyblind activate <key> Activate a Pro/Team license
keyblind deactivate Remove current license
keyblind status Show license and vault status
keyblind audit Show secret resolution audit log
keyblind check --expired List secrets past expiry
keyblind rotate <name> Update a secret value
keyblind rotate <name> --generate Rotate with an auto-generated value
keyblind rotate <name> --exec "<cmd>" Rotate via an external command's stdout
keyblind rotate --overdue [days] Rotate all secrets past the threshold
keyblind rotate-needed [days] List secrets not rotated in N days (default 90)
keyblind agents list List registered AI agents
keyblind agents register <name> <sponsor> [scope] Register an agent (prints signing key)
keyblind agents verify Verify agent ledger integrity
keyblind agents export [json|csv] Export compliance report
keyblind agents enforce on|off Require signed agent identity for secret access
keyblind policy set <secret> <policy> Restrict which agents may access a secret
keyblind policy list List per-secret policies
keyblind approvals list List pending approval requests
keyblind approvals approve <id> Approve and execute a pending request
keyblind approvals deny <id> Deny a pending request
keyblind approvals require on|off Require approval for all agent writes
keyblind approvals require <secret> Require approval for a specific secret
keyblind approvals unrequire <secret> Stop requiring approval for a secret
keyblind control-plane init Generate the org signing keypair
keyblind control-plane export Export a signed, value-free control-plane bundle
keyblind control-plane trust <pubkey> Trust an org public key (honor its deny list)
keyblind control-plane untrust <pubkey> Remove a trusted org public key
keyblind control-plane trusted List trusted org public keys
keyblind control-plane apply <file> Import a signed deny list (revoked agents)
keyblind control-plane revoke <agentId> [reason] Revoke an agent locally
keyblind control-plane unrevoke <agentId> Un-revoke an agent locally
keyblind control-plane connect <url> Connect to a hosted control plane (org API base)
keyblind control-plane sync Pull + apply the signed manifest (deny list + group grants)
keyblind control-plane disconnect Forget the hosted control-plane connection
keyblind control-plane status Show the current connection (if any)
keyblind scan-repo [--all] Scan tracked files (or full history) for secrets
keyblind setup-ci Write a GitHub Actions secret-scan workflow
keyblind ci export Export an encrypted bundle for CI injection (Pro)
keyblind ci inject Decrypt a bundle and write secrets to $GITHUB_ENV
keyblind ci setup Write a GitHub Actions workflow for CI injection
keyblind team init [path] Create a shared team vault
keyblind team push <name> Push a secret to team vault
keyblind team pull Pull secrets from team vault
keyblind team list List secrets in team vault
keyblind totp set <name> Store TOTP 2FA config
keyblind totp code <name> Generate current TOTP code
keyblind totp list List all TOTP configs
keyblind totp delete <name> Delete a TOTP config
keyblind share <name> Create encrypted share link
keyblind receive <url> Receive a shared secret
keyblind deadman setup Configure dead man's switch
keyblind deadman checkin Reset dead man's switch timer
keyblind deadman status Show dead man's switch status
keyblind deadman disable Disable dead man's switch
keyblind sso configure Set up SSO/OIDC for team access
keyblind sso login Authenticate via browser SSO
keyblind sso logout Clear SSO session
keyblind sso status Show SSO auth status
keyblind doctor Run vault health check
keyblind generate <name> Generate a strong random secret
keyblind import [.env] Bulk import from .env file
keyblind export Export all secrets
keyblind completions [shell] Generate shell completion scriptgit clone https://github.com/aarifmms/keyblind.git
cd keyblind
npm install
npm run build # Compile TypeScript
npm test # Run tests
npm run dev # Watch modeMIT
View the audit log of secret resolutions, stores, and deletes. Shows who accessed which secret and when.
Inputs: limit.
Check in to reset the dead man's switch timer.
Inputs: no named parameters.
Check dead man's switch status — days until vault access is released to designated contacts.
Inputs: no named parameters.
Delete a secret from the vault.
Inputs: name (required), exp, nonce, token, +2 more.
Export the agent action ledger as a compliance report (JSON or CSV) with human-sponsor attribution.
Inputs: format.
List all agents in the Know Your Agent registry.
Inputs: no named parameters.
List all stored secret names (names only — values are never revealed in this listing).
Inputs: exp, nonce, token, agentId, +1 more.
Append a signed action to the tamper-proof agent ledger. Each entry is hash-chained and Ed25519-signed, so any later edit or reorder is detectable.
Inputs: action (required), agentId (required), privateKey (required), target, +1 more.
Register an AI agent in the Know Your Agent registry, bound to a human sponsor. Returns the agent identity and its Ed25519 private key, which the agent holds to sign its own actions.
Inputs: name (required), sponsor (required), scope.
Resolve a secret by name using the configured backend (local vault, 1Password, Bitwarden, or env vars). Returns the decrypted value at runtime. The secret value is never visible in the LLM conversation transcript — it is resolved just-in-time for the current operation.
Inputs: name (required), exp, nonce, token, +2 more.
Replace real values in your .env file with deterministic fake values. Real values are encrypted and backed up to the vault. AI agents reading .env files will only see fakes. Use unsandbox_env to restore real values.
Inputs: filePath.
Check SSO/OIDC authentication status for team vault access.
Inputs: no named parameters.
Store a secret in the encrypted vault. The value is encrypted with AES-256-GCM before storage. The secret value is never visible in the LLM conversation transcript after this call.
Inputs: name (required), value (required), exp, nonce, +3 more.
Delete a secret from the team vault.
Inputs: name (required), passphrase (required).
Create a new shared team vault (encrypted SQLite). Requires a passphrase.
Inputs: passphrase (required), path.
List all secret names in the team vault.
Inputs: passphrase (required).
Import all secrets from the team vault into your local vault.
Inputs: passphrase (required).
Push a local secret to the shared team vault.
Inputs: name (required), passphrase (required), value.
Resolve (decrypt) a single secret from the team vault.
Inputs: name (required), passphrase (required).
Generate a TOTP 2FA code for a stored secret. Returns the current 6 or 8 digit code and seconds remaining until rotation.
Inputs: name (required).
Delete a stored TOTP configuration.
Inputs: name (required).
List all stored TOTP configurations.
Inputs: no named parameters.
Store a TOTP configuration from an otpauth:// URI (from QR code scan or manual entry).
Inputs: uri (required), name (required).
Restore real .env values from the vault. Reverses the sandbox operation.
Inputs: filePath.
Verify the integrity of the agent action ledger by re-walking the hash chain and signatures. Returns the first sequence that fails if the ledger was tampered with.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 27 tools
Tools are organized into clear domain clusters (team_*, totp_*, deadman_*, plus local secret and agent-ledger operations), so most purposes are distinguishable. The main risk is the parallel local vs. team vault surface (store_secret vs team_push, resolve_secret vs team_resolve, list_secrets vs team_list, delete_secret vs team_delete), which an agent could occasionally confuse, but naming largely disambiguates them.
Everything is snake_case and readable, grouped by domain prefix (team_, totp_, deadman_). The ordering is slightly mixed—some are noun-first prefixes (team_init, sso_status) while others are verb-first (store_secret, register_agent, create_share_link)—but the convention is predictable enough to follow.
27 tools is heavy for one server and spans many distinct sub-domains (team vault, KYA/agent ledger, local secrets, TOTP, env sandboxing, secret sharing, dead man's switch). Each tool is meaningful, but the breadth pushes this into borderline-overloaded territory.
Coverage is strong across nearly every domain: team vault CRUD, local secret lifecycle, TOTP store/code/list/delete, agent register/record/verify/export, share create/receive, and dead man's switch status/checkin. Minor gaps exist (e.g. no explicit secret rotation/update, limited SSO beyond status), but agents can work around these.
A secret store for AI agents: the agent never sees the plaintext.
A vault for .env files and project credentials: one encryption key per project, a second factor before protected values open, an audit row for every reveal, and scoped MCP access for coding agents.
Encrypted secret store and rotation for autonomous agent credentials
Secrets for developers and agents—secure context and workflows without exposing secret values.
