Clavis

kn0wbot/clavis-mcp

Gives Claude secure access to credentials without hardcoding them in your config. Exposes three tools: get_credentials to retrieve valid tokens, list_services to see what's stored, and check_credential_status to verify expiry. Handles the annoying stuff like OAuth token refresh automatically and logs every credential access for security auditing. Uses AES-256 encryption for the vault and includes distributed rate limiting to prevent API quota burns. Reach for this when you're building agents that need to authenticate with external services but you don't want API keys sitting in plaintext or tokens expiring mid-conversation.

tools: 4
transport: STDIO
last updated: Jul 26, 2026

View on GitHub

Tools

4 tools

Public tool metadata for what this MCP can expose to an agent.

call_serviceMake an API call with server-side credential injection — the credential is injected into the upstream request server-side, so the raw key never enters the conversation.

Make an API call with server-side credential injection — the credential is injected into the upstream request server-side, so the raw key never enters the conversation.

No parameter schema in public metadata yet.

get_credentialsLegacy. Returns the raw access token or API key for a named service. Prefer call_service.

Legacy. Returns the raw access token or API key for a named service. Prefer call_service.

No parameter schema in public metadata yet.

list_servicesList all services with stored credentials

List all services with stored credentials

No parameter schema in public metadata yet.

check_credential_statusCheck the status and expiry of credentials for a service

Check the status and expiry of credentials for a service

No parameter schema in public metadata yet.

Readme

Clavis MCP Server

Secure credential management for Claude Desktop and MCP servers.

Features

🔐 Encrypted credential storage (AES-128-CBC + HMAC-SHA256, via Fernet)
🛡️ Server-side credential injection — the raw key never enters the conversation
🔄 Automatic OAuth token refresh
📡 Thin forwarding layer — rate limiting, audit logging, and usage tracking are all handled by the Clavis server

Installation

npx @clavisagent/mcp-server

Or install globally:

npm install -g @clavisagent/mcp-server

Usage with Claude Desktop

Add the following to your Claude Desktop configuration file (claude_desktop_config.json):

{
  "mcpServers": {
    "clavis": {
      "command": "npx",
      "args": ["-y", "@clavisagent/mcp-server"],
      "env": {
        "CLAVIS_API_KEY": "eyJ..."
      }
    }
  }
}

Usage with Claude Code

claude mcp add clavis -- npx -y @clavisagent/mcp-server

Configuration

View the full README on GitHub

Details

Repository: github.com/kn0wbot/clavis-mcp
Package: @clavisagent/mcp-server
Transport: STDIO
Registry: MCP registry, active