Which integrations are available for this server?

Provides authenticated HTTP requests to GitHub's API using Bearer token authentication. Provides persistent connections to Odoo's XML-RPC interface for executing methods. Provides persistent database connections to PostgreSQL for executing queries. Provides authenticated HTTP requests to Stripe's API using Bearer token authentication.

How do I use GhostKey?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@GhostKey use my stripe credential to get recent charges" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

GhostKey

by woodwosj

Overview Schema Source Related Servers Discussions Admin

TypeScript

Hybrid

GhostKey

MCP-native credential vault — AI agents authenticate without holding secrets.

npm version npm downloads License: MIT Node.js

What is GhostKey?

GhostKey is an MCP server that manages credentials on behalf of AI agents. Agents never see raw secrets — they call MCP tools like ghostkey_request or ghostkey_connect, and GhostKey injects the right authentication transparently.

Zero secret exposure — agents authenticate without holding API keys, passwords, or tokens
7 auth patterns — bearer, basic, API key header, custom header, XML-RPC, OAuth2, query parameter
Persistent connections — managed PostgreSQL and XML-RPC/Odoo sessions
Works with any MCP client — Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI, and more

Related MCP server: clavis-mcp-server

Tiers

Feature	Local (Free)	Cloud Backup (Free)	Pro ($10/mo)	Enterprise
Encrypted local vault	✓	✓	✓	✓
MCP stdio transport	✓	✓	✓	✓
Midnight cloud backup	—	✓	✓	✓
HTTP relay (remote agents)	—	—	✓	✓
Included ops/month	—	—	5,000	Unlimited
Cardano NFT ownership	—	—	✓	✓
Own wallet mode	—	—	✓	✓
Self-hosted proof server	—	—	—	✓
SSO / RBAC	—	—	—	✓

Install

npm install -g ghostkey

Or run without installing:

npx ghostkey

Quick Start

# 1. Create a vault
ghostkey init

# 2. Register a credential
ghostkey register --id stripe --type bearer --base-url https://api.stripe.com

# 3. Configure your AI client
ghostkey setup

# 4. Agents use MCP tools — no secrets exposed
#    ghostkey_request { credential_id: "stripe", method: "GET", url: "/v1/charges" }

MCP Client Configuration

Add GhostKey to your MCP client config:

{
  "mcpServers": {
    "ghostkey": {
      "command": "npx",
      "args": ["-y", "ghostkey"]
    }
  }
}

Config file locations:

Client	Config Path
Claude Desktop	`~/Library/Application Support/Claude/claude_desktop_config.json`
Claude Code	`~/.claude.json`
Cursor	`.cursor/mcp.json` in your project
VS Code (Copilot)	`.vscode/mcp.json` in your project

MCP Tools

Tool	Description
`ghostkey_list`	List stored credentials, optionally filtered by tag, scope, or description
`ghostkey_status`	System status or detailed credential info with expiry warnings
`ghostkey_request`	Authenticated HTTP request using a stored credential
`ghostkey_connect`	Open a persistent connection (PostgreSQL or XML-RPC/Odoo)
`ghostkey_query`	Execute a query on an existing managed connection

Auth Patterns

Type	Use Case
`bearer`	REST APIs with Bearer tokens (Stripe, GitHub, etc.)
`basic`	HTTP Basic authentication (username:password)
`api_key_header`	APIs that use a custom header for the key (e.g., `X-API-Key`)
`custom_header`	Arbitrary header with a `{{secret}}` template
`xmlrpc`	XML-RPC services (Odoo `execute_kw` pattern)
`oauth2`	OAuth2 client credentials with automatic token refresh
`query_param`	Secret injected as a URL query parameter

Security

GhostKey is designed with defense-in-depth:

Argon2id key derivation (password to 256-bit AES key)
AES-256-GCM authenticated encryption for all stored credentials
SSRF prevention — domain whitelisting per credential, private IP blocking
CRLF injection — rejected in all header values
Error sanitization — credentials never leak in error messages or MCP responses
Buffer zeroing — best-effort secret wipe on shutdown
File permissions — vault directory 700, credential file 600

Privacy

No telemetry — GhostKey collects zero usage data
No network calls — in local vault mode, nothing leaves your machine
No cloud dependency — works fully offline with local vault storage
Credentials never logged — secrets are excluded from all error messages, MCP responses, and debug output
Your vault, your data — vault files are standard AES-256-GCM encrypted files on your filesystem

CLI Reference

Command	Description
`ghostkey init`	Create a new credential vault
`ghostkey register`	Add a new credential to the vault
`ghostkey list`	List credential metadata
`ghostkey status`	Show vault health status
`ghostkey rotate`	Update a credential secret
`ghostkey revoke`	Deactivate a credential
`ghostkey start`	Launch MCP server with stdio transport
`ghostkey setup`	Configure LLM clients to use GhostKey

Supported Clients

GhostKey auto-detects and configures itself for these MCP clients:

Client	Auto-Setup	Transport
Claude Desktop	`ghostkey setup`	stdio
Claude Code	`ghostkey setup`	stdio
Cursor	`ghostkey setup`	stdio
VS Code (Copilot)	`ghostkey setup`	stdio
Windsurf	`ghostkey setup`	stdio
Gemini CLI	Manual	stdio
Continue	Manual	stdio
Custom	Manual	stdio/SSE

License

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityStale

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Related MCP Connectors

JustOnceOAuth
ai.justonce
Persistent memory for AI assistants — one shared, OAuth-secured vault for every MCP client.
Knowledge & Memory Security
1
FullmaktOAuth
ai.fullmakt
Credential broker for AI agents: scoped, revocable API access with policy enforcement and audit.
Security Autonomous Agents Agent Orchestration
1
Hive Secrets A
io.github.srotzin
Encrypted secret store and rotation for autonomous agent credentials
Security Autonomous Agents
2
OpenAkashic B
io.github.szara7678
Shared long-term memory vault for AI agents with 20 MCP tools.
Knowledge & Memory Autonomous Agents Agent Orchestration
3523

Related MCP Servers

API Locker
Security Developer Tools App Automation
apilocker
A
license
Not graded
quality
D
maintenance
Encrypted credential vault with a 21-tool MCP server. Store and manage LLM API keys, service API keys, and OAuth credentials — then let your AI agent list, reveal, rotate, rename, pause, and proxy calls through them.
Updated 5 months ago (2026-04-10 19:09 UTC)
MIT
clavis-mcp-server
Security Developer Tools
KN0WBOT
A
license
A
quality
B
maintenance
Secure credential management for AI agents — encrypted storage, auto-refresh, and rate limiting via a single MCP call. Supports OpenAI, Anthropic, Stripe, GitHub, Brave Search, Kalshi, Coinbase, plus generic API key and OAuth2 for any service.
Updated a month ago (2026-08-16 00:52 UTC)
4
47 npm
MIT
MCP-Secrets-Vault
Security Developer Tools Autonomous Agents
gpitrella
F
license
Not graded
quality
D
maintenance
Enables AI agents and MCP clients to securely store, retrieve, and manage encrypted credentials without hardcoding API keys.
Updated 3 months ago (2026-06-18 01:57 UTC)
-
Coffer MCP
Security Web Scraping Browser Automation
annawhooo
A
license
Not graded
quality
B
maintenance
Credential vault for LLM agents that stores credentials encrypted and exposes MCP tools for authenticated HTTP requests, web scraping, and credential management, preventing AI assistants from seeing secrets.
Updated a month ago (2026-08-13 02:39 UTC)
Apache 2.0

GhostKey

What is GhostKey?

Tiers

Install

Quick Start

MCP Client Configuration

MCP Tools

Auth Patterns

Security

Privacy

CLI Reference

Supported Clients

License

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

API Locker

clavis-mcp-server

MCP-Secrets-Vault

Coffer MCP