Keyway MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| KEYWAY_API_URL | No | Override API URL (default: https://api.keyway.sh) | https://api.keyway.sh |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| keyway_list_secretsA | List all secret names in the Keyway vault for the current repository. Returns only the keys, not the values. |
| keyway_set_secretB | Create or update a secret in the Keyway vault. The key must be uppercase with underscores (e.g., DATABASE_URL). |
| keyway_inject_runB | Run a command with Keyway secrets injected as environment variables. Secrets are only available to this command. |
| keyway_list_environmentsB | List available environments for the current repository vault. |
| keyway_scanC | Scan the codebase for potential secret leaks. Detects AWS keys, GitHub tokens, Stripe keys, private keys, and more. |
| keyway_diffC | Compare secrets between two environments to find differences. |
| keyway_generateA | Generate a secure secret and store it directly in the vault. The value is never exposed in the conversation. |
| keyway_validateB | Validate that required secrets exist in an environment. Useful for pre-deployment checks. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose with no overlap: diff compares environments, generate creates secrets, inject_run executes commands, list_environments and list_secrets retrieve metadata, scan detects leaks, set_secret modifies data, and validate checks completeness. The descriptions make it impossible to confuse any two tools.
All tools follow a consistent 'keyway_verb_noun' pattern with snake_case throughout (e.g., keyway_diff, keyway_generate, keyway_inject_run). This predictable naming scheme makes it easy for agents to understand and select the right tool based on its function.
With 8 tools, this server is well-scoped for secret management, covering essential operations like listing, setting, generating, validating, scanning, and injecting secrets, as well as environment comparison. Each tool serves a unique and necessary function without redundancy.
The toolset provides complete coverage for secret management workflows: CRUD operations (list, set, generate), environment handling (list, diff), security (scan, validate), and runtime integration (inject_run). There are no obvious gaps, enabling agents to handle the full lifecycle of secrets in this domain.