cryptofort

Why CryptoFort

Secrets sprawl across .env files, shell history, and plaintext columns — and agents have no safe, structured way to ask for them. CryptoFort seals every secret with authenticated encryption, keeps the key out of the database entirely, and hands agents a narrow MCP interface that returns metadata by default and plaintext only on an explicit get.

Related MCP server: API Locker

Install

npm install cryptofort
# plus the driver for your backend:
npm install @supabase/supabase-js   # or: better-sqlite3 | postgres

CryptoFort is also published to GitHub Packages as @bradley-t-t/cryptofort. Point the @bradley-t-t scope at the GitHub registry and authenticate with a token that has read:packages — GitHub Packages requires auth even for public packages:

@bradley-t-t:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

npm install @bradley-t-t/cryptofort

Library usage

import { Vault, Crypto, SqliteAdapter } from 'cryptofort';

const adapter = new SqliteAdapter('vault.db');
await adapter.init();

const vault = new Vault({
  adapter,
  crypto: new Crypto({ key: process.env.CRYPTOFORT_MASTER_KEY! }),
});

await vault.put({
  name: 'stripe-secret-key',
  secret: 'sk_live_…',
  provider: 'stripe',
  tags: ['payments'],
});
await vault.search('stripe'); // metadata only — never the secret
await vault.get('stripe-secret-key'); // the decrypted secret

Generate a master key (base64, 32 bytes):

node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

…or from the library with import { generateKey } from 'cryptofort'.

MCP server

Point any MCP client at the cryptofort-mcp binary:

{
  "mcpServers": {
    "cryptofort": {
      "command": "cryptofort-mcp",
      "env": {
        "CRYPTOFORT_ADAPTER": "supabase",
        "SUPABASE_URL": "https://<ref>.supabase.co",
        "SUPABASE_SERVICE_ROLE_KEY": "<service-role-key>",
        "CRYPTOFORT_MASTER_KEY": "<base64-32-bytes>"
      }
    }
  }
}

The server is read-only by default. Add "args": ["--allow-write"] to expose credential_put.

Tools

Environment

Backends

How it works

• Only the secret is ciphertext. name, description, provider, and tags stay plaintext, so search and listing work without ever decrypting.

• Each secret is sealed with AES-256-GCM — authenticated encryption, so any tampering is caught on read.

• The master key never touches the database. It lives only in CRYPTOFORT_MASTER_KEY; a stolen dump reveals nothing without it.

• The MCP server refuses writes unless started with --allow-write, so an agent can look secrets up but cannot quietly rewrite the vault.

Schema

See sql/001_cryptofort_credentials.sql — one table, one ciphertext column, the rest plaintext metadata for search.

Development

npm run build      # bundle with tsup
npm test           # run the vitest suite
npm run typecheck  # tsc --noEmit

License

Released under the MIT License.