Keymaster Mcp
Bridges Claude to HashiCorp Vault through the Keymaster service for read-only secret retrieval at runtime. The server lets AI agents pull credentials and configuration values from Vault without baking secrets into prompts or configuration files. Useful when you're building autonomous workflows that need to authenticate against external services but shouldn't have secrets hardcoded anywhere in the chain. The read-only constraint keeps agents from accidentally rotating or deleting production secrets. If you're already running Vault and want Claude to handle tasks that require dynamic credential access, this gives you that connection without expanding the agent's write surface.
- GitHub stars
- 1
- tools
- 5
- auth
- Secret needed
- transport
- STDIO
- env vars
- 2
- last updated
- Apr 2, 2026
Tools
5 toolsPublic tool metadata for what this MCP can expose to an agent.
secret_statusCheck one approved credential without returning its value.
Check one approved credential without returning its value.
No parameter schema in public metadata yet.
list_servicesDiscover supported service/key-name pairs.
Discover supported service/key-name pairs.
No parameter schema in public metadata yet.
list_secretsList approved paths as metadata only.
List approved paths as metadata only.
No parameter schema in public metadata yet.
healthcheckValidate credentials upstream and return statuses only.
Validate credentials upstream and return statuses only.
No parameter schema in public metadata yet.
rotate_secretReturn safe rotation guidance without accepting a replacement value.
Return safe rotation guidance without accepting a replacement value.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
USER_KEYMASTER_URL*Keymaster proxy URL
USER_KEYMASTER_TOKEN*secretBearer token for Keymaster authentication
Readme
Keymaster MCP
Trust infrastructure for human–AI teams.
日本語 · Five-minute demo · Adoption playbook · Philosophy · Threat model
Keymaster lets agents discover whether approved capabilities exist and whether their credentials are healthy without returning production credentials to the model. Its companion Outcome Contract accepts results only when external evidence—not the executor's own report—supports the claim.
bounded permission → trusted execution → external evidence → accepted result → next permission
Interactive preflight lab (no secrets, no login)
Try the agent continuity simulator — switch GitHub, Notion, and Stripe between ready / needs authorization / service unavailable. See which independent work can continue when one provider fails.
Details
- Repository
- github.com/ainoakari/keymaster-mcp
- Package
@akari-os/keymaster-mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active