An Agent Plugin (v1.0.0) packaging the two Model Context Protocol servers for seekrit, a multi-tenant, end-to-end encrypted secrets manager built for AI agents and CI:
seekrit— the local crypto-plane server (@seekrit/mcp, stdio). Runs on your machine, decrypts secrets, and injects them into commands. This is the one that actually resolves secret values.seekrit-cloud— the hosted metadata-plane server (mcp.seekrit.dev, Streamable HTTP). Lets an agent self-register, discover secrets/orgs, and manage access — without ever seeing plaintext. It redirects crypto operations back to the local server.
Both servers are zero-knowledge: plaintext secrets, private keys, and passphrases are only ever handled by @seekrit/mcp running locally. seekrit-cloud never sees them.
You need a machine (M2M) credential pair. Mint one with:
curl -X POST https://mcp.seekrit.dev/signupThis returns { org, m2m: { clientId, clientSecret } }. Keep clientSecret private — treat it like a password.
If you already use the seekrit CLI, running seekrit login (or any authenticated command) writes these to ~/.config/seekrit/config.json, and the local server in this plugin will pick them up automatically with no further configuration.
Agent Plugin v1 doesn't define a portable way to carry secrets in a plugin package (mcp.json env/header values are static, non-secret file contents — see the spec). Configure credentials through whatever your host provides for installed MCP servers:
seekrit (local, stdio) — reads credentials from the environment or ~/.config/seekrit/config.json. If your host lets you set per-server environment variables after installing, add:
| Variable | Purpose |
|---|---|
SEEKRIT_CLIENT_ID |
Machine client ID from the signup step above. |
SEEKRIT_CLIENT_SECRET |
Machine client secret paired with the client ID. |
SEEKRIT_TOKEN |
An existing skt_… service/admin token, used instead of the two above. |
SEEKRIT_PASSPHRASE |
Only needed for tools that decrypt when authenticating with SEEKRIT_TOKEN (not needed for M2M credentials). |
SEEKRIT_API_URL |
Override the API base URL. Defaults to the hosted seekrit API. |
If your host doesn't expose per-server env configuration, skip this — seekrit login (from @seekrit/cli) is the simplest path.
seekrit-cloud (remote, Streamable HTTP) — requires an Authorization header:
Authorization: Basic <base64(clientId:clientSecret)>
Add this via your host's settings for the installed server. Do not commit real credentials into this plugin's mcp.json or fork it with secrets baked in.
- Docs: MCP server
- Docs: AI agents guide
- Also listed on the official MCP registry as
dev.seekrit/mcpanddev.seekrit/remote-mcp.
MIT © seekrit