Which integrations are available for this server?

Provides access to a running, unlocked KeePassXC instance over its browser-integration socket, enabling lookup of logins (username/password/TOTP) by URL, retrieval of TOTP codes, creating or updating logins, generating passwords, browsing and creating groups, checking status/association, and locking the database.

How do I use keepassxc-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@keepassxc-mcp get the login for https://github.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

keepassxc-mcp

MCP server for KeePassXC. It talks to the running, unlocked app over the same browser-integration socket the Chrome/Firefox extension uses. Hermes (or any MCP client) can then look up and save credentials without copy-paste.

It never opens your .kdbx file and never asks for the master password.

What you get

Tool	Does
`status`	Reachable? Associated? Database hash + KeePassXC version
`associate`	First-time pairing (KeePassXC shows a confirm dialog)
`get_logins`	Username/password/TOTP for a URL
`get_totp`	Current TOTP for an entry UUID
`set_login`	Create or update a login
`generate_password`	KeePassXC's generator
`get_database_groups`	Folder tree
`create_group`	New group/path
`lock_database`	Lock the open database

Lookups are by URL, not title — that is a KeePassXC protocol limit, not this server's.

Related MCP server: passwords-mcp

Requirements

KeePassXC 2.7+ with Browser Integration enabled (Settings → Browser Integration)
Database unlocked
Python 3.10+

On this laptop the socket is already present when KeePassXC is running:

/run/user/$UID/org.keepassxc.KeePassXC.BrowserServer

Install

git clone https://github.com/preginald/keepassxc-mcp.git
cd keepassxc-mcp
uv sync --all-extras

Or without uv:

pip install -e '.[dev]'

Hermes

hermes mcp add keepassxc \
  --command uv \
  --args --directory /ABS/PATH/TO/keepassxc-mcp run keepassxc-mcp

Restart Hermes after adding. First real lookup pops a KeePassXC dialog named something like keepassxc-mcp — accept it once. The association is stored at ~/.local/share/keepassxc-mcp/identity.json (mode 0600).

Then: "get my GitHub login" or "save this API key in KeePassXC for https://api.example.com".

Other MCP clients

stdio command:

uv --directory /ABS/PATH/TO/keepassxc-mcp run keepassxc-mcp

or python -m keepassxc_mcp from an environment that has the package installed.

Environment

Variable	Meaning
`KEEPASSXC_SOCKET`	Unix socket path (otherwise auto-detected)
`KEEPASSXC_HOST` / `KEEPASSXC_PORT`	TCP instead of Unix (for a forwarded socket)
`KEEPASSXC_MCP_IDENTITY`	Identity file path
`KEEPASSXC_TIMEOUT`	Seconds (default 30; association waits up to 120)

Security

Secrets travel encrypted (NaCl box) between this process and KeePassXC, then as MCP tool results to the agent.
The agent will see passwords it fetches. Do not attach this server to an untrusted chat.
Writes still go through KeePassXC; it may prompt you.
Identity file is equivalent to a browser-extension pairing key. Keep it 0600 and local.

Tests

uv run pytest

Tests use an in-process fake KeePassXC. They never touch a real vault.

Protocol

keepassxc-browser protocol

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Related MCP Connectors

MANDATE Credential Broker B
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
https://mandate.nanocorp.app/mcp
Tap
io.github.LeonTing1010
Browser MCP for logged-in tasks. Uses your Chrome — credentials stay local. Zero-token replay.
Browser Automation Web Scraping
218
https://mcp.taprun.dev/mcp
BitsWeaveOAuth
com.bitsweave
Read and write shared BitsWeave context, projects, tasks, and work sessions through MCP.
Project Management Knowledge & Memory Workplace & Productivity
1
https://bitsweave.com/api/mcp
KeepMySubsOAuth
com.keepmysubs
Manage your KeepMySubs subscriptions, spend, renewals, and bills from any MCP client.
Finance Payments & Billing
2
https://keepmysubs.com/mcp

Related MCP Servers

auth-vault
Security Browser Automation
borysttk
A
license
B
quality
C
maintenance
MCP server for secure credential management, browser-based login automation, and TOTP/2FA auto-solving. Encrypts credentials with AES-256-GCM and automates login flows via Playwright.
Updated 2 months ago (2026-08-14 18:24 UTC)
32
2
MIT
passwords-mcp
Security
megamaced
A
license
A
quality
A
maintenance
MCP server for the Nextcloud Passwords app, enabling reading and managing password entries (list, search, create, update, delete) with strong security guarantees.
Updated 10 days ago (2026-10-19 19:12 UTC)
14
MIT
enpass-mcp
Security Databases
bitterdev
A
license
A
quality
B
maintenance
Provides local, secure access to Enpass password vaults via MCP. Enables unlocking vaults, listing entries, retrieving passwords, TOTP codes, and attachments, with optional write support.
Updated 10 days ago (2026-10-19 18:15 UTC)
10
30 npm
3
MIT
vaultwarden-mcp
Security
jr2804
A
license
Not graded
quality
A
maintenance
MCP server for accessing Vaultwarden servers with multi-account support.
Updated 23 days ago (2026-10-07 00:23 UTC)
MIT