MCP server that lets AI agents call APIs without ever seeing the credentials.
Secrets live in a local encrypted vault. The server substitutes them at call time into outbound HTTP requests or subprocess environment variables, under a per-secret allowlist policy. The model only ever sees secret names, never values.
Homepage: https://agenticvault.madhoob.dev
Letting an AI agent make authenticated calls usually means giving it the raw API key. That breaks least-privilege, pollutes transcripts and logs, and means one jailbreak or prompt-injection is enough to exfiltrate the token.
Agentic Vault splits the two: the agent picks a secret by name and a destination; the vault checks the policy and injects the value. The plaintext never crosses the tool boundary.
npm install -g secretproxy
secretproxy init # creates the global vault, stores master password in the OS keychain
secretproxy add OPENROUTER_API_KEY sk-or-...
secretproxy policy set OPENROUTER_API_KEY --host openrouter.ai
secretproxy run # start the MCP server over stdioThen point any MCP client (Claude Code, Cursor, Cline, Codex, Zed) at secretproxy run.
| Tool | Purpose |
|---|---|
list_secrets |
Enumerate available secret names (no values) |
http_request |
Make an HTTP call with a secret injected into headers, query, or body |
run_command |
Run a subprocess with secrets injected as env vars |
scan_env_requirement |
Detect what env vars a project expects and match them to stored secrets |
- Zero-plaintext injection — values substituted inside the vault, never in the model context
- Per-secret policy — allow-lists for HTTP hosts, commands, env vars; deny by default; optional wildcards (strict mode rejects them)
- AES-256-GCM vault with argon2id key derivation
- Encrypted audit trail — every call logged with policy decision, surface, outcome
- Scoped vaults — global defaults + per-project overrides
- OS-native password storage — macOS Keychain, libsecret, Windows Credential Manager
- Interactive TUI (
secretproxy tui) and local-only web UI (secretproxy ui) - Rate limiting with token buckets
- Zero telemetry — no outbound calls, local-only by design
npm install
npm test # 328 tests across 45 files
npm run build
npm run typecheckArchitecture primer: src/vault/ owns encryption, src/mcp/ owns the MCP tool surface, src/policy/ owns allowlist enforcement, src/audit/ owns the append-only log.
AGPL-3.0-or-later for open-source use — see LICENSE.
If your use case is incompatible with AGPL's network-copyleft clause (embedding in a proprietary product, offering as a managed service without source disclosure, etc.), a commercial license is available — see COMMERCIAL-LICENSE.md.
Contact: haaamcar@gmail.com