Keymaster MCP server
{
"mcpServers": {
"ainoakari-keymaster": {
"command": "npx",
"args": [
"-y",
"@akari-os/keymaster-mcp@latest"
],
"env": {
"USER_KEYMASTER_TOKEN": "<user_keymaster_token>"
}
}
}
}{
"mcpServers": {
"ainoakari-keymaster": {
"command": "npx",
"args": [
"-y",
"@akari-os/keymaster-mcp@latest"
],
"env": {
"USER_KEYMASTER_TOKEN": "<user_keymaster_token>"
}
}
}
}{
"mcpServers": {
"ainoakari-keymaster": {
"command": "npx",
"args": [
"-y",
"@akari-os/keymaster-mcp@latest"
],
"env": {
"USER_KEYMASTER_TOKEN": "<user_keymaster_token>"
}
}
}
}{
"servers": {
"ainoakari-keymaster": {
"command": "npx",
"args": [
"-y",
"@akari-os/keymaster-mcp@latest"
],
"env": {
"USER_KEYMASTER_TOKEN": "${input:user_keymaster_token}"
}
}
},
"inputs": [
{
"id": "user_keymaster_token",
"type": "promptString",
"description": "User keymaster token",
"password": true
}
]
}{
"mcpServers": {
"ainoakari-keymaster": {
"command": "npx",
"args": [
"-y",
"@akari-os/keymaster-mcp@latest"
],
"env": {
"USER_KEYMASTER_TOKEN": "<user_keymaster_token>"
}
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsoninstall npx -y @akari-os/keymaster-mcpversion 1.0.2
What it does
Keymaster is an MCP server that enables AI agents to check whether credentials exist and are healthy in HashiCorp Vault without exposing the actual credential values to the model. It is designed for teams running autonomous AI agents that need to verify access to secrets while maintaining security boundaries.
- Check whether a credential is available and functional before attempting an authenticated operation, without revealing the credential itself.
- Discover which services and secret paths the agent has approved access to, for capability discovery without credential disclosure.
- Validate that upstream credentials are healthy and rotation guidance can be provided without the agent ever seeing the raw values.
Tools this server exposes
| Tool | Does |
|---|---|
| secret_status | Check whether an approved credential exists and is available without returning its value. |
| list_services | Discover supported service and key-name pairs that the agent has approved access to. |
| list_secrets | List approved credential paths as metadata only, without revealing values. |
| healthcheck | Validate that upstream credentials are working and return their statuses without exposing raw values. |
| rotate_secret | Return safe credential rotation guidance without accepting or exposing replacement values. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.