agent-secrets

Encrypted secrets management MCP server for AI agents. Store, retrieve, rotate, and audit API keys, tokens, and credentials — all encrypted at rest.

Why

AI agents need access to API keys, tokens, and credentials. Hardcoding them or passing via env vars is insecure and unmanageable at scale. agent-secrets provides a single encrypted vault with audit trails, access policies, and rotation — exposed as MCP tools any agent can call.

Related MCP server: MCP-Secrets-Vault

Features

• AES-128 encryption at rest (Fernet: AES-128-CBC + HMAC-SHA256)

• 14 MCP tools: store, get, list, update, rotate, revoke, delete, search, audit, policies, batch, stats

• Access policies: allow/deny patterns, type restrictions

• Full audit log: every access tracked

• Secret rotation: rotate with history

• CLI + MCP server: use from terminal or any MCP-compatible agent

Quick start

pip install agent-secrets

# CLI
agent-secrets store OPENAI_API_KEY sk-... --type api_key --tag prod
agent-secrets get OPENAI_API_KEY --show
agent-secrets list
agent-secrets rotate OPENAI_API_KEY
agent-secrets audit

# MCP server
agent-secrets serve --db ~/.agent-secrets/vault.db

MCP tools

License

MIT