Credential Broker
Local-first credential broker: agents use gated APIs through scoped, audited requests, never keys.
- GitHub stars
- 3
- tools
- 6
- auth
- Required
- transport
- STDIO
- env vars
- 6
- last updated
- Nov 9, 2026
Tools
6 toolsPublic tool metadata for what this MCP can expose to an agent.
broker_whoamiShow the authenticated agent and its per-credential operation grants.
Show the authenticated agent and its per-credential operation grants.
No parameter schema in public metadata yet.
broker_list_credentialsGranted credentials: id, kind, base URL, provisioned or not. Never values.
Granted credentials: id, kind, base URL, provisioned or not. Never values.
No parameter schema in public metadata yet.
broker_explain_requestDry run: would this request be permitted, which rule decides it, and is an approval required or satisfied? No upstream call, no secret touched.
Dry run: would this request be permitted, which rule decides it, and is an approval required or satisfied? No upstream call, no secret touched.
No parameter schema in public metadata yet.
broker_readGET or HEAD through a granted credential. Honestly annotated read-only.
GET or HEAD through a granted credential. Honestly annotated read-only.
No parameter schema in public metadata yet.
broker_mutatePOST, PUT, PATCH, or DELETE. Annotated destructive and non-idempotent, because its strongest capability is. May require an approval and an idempotency key.
POST, PUT, PATCH, or DELETE. Annotated destructive and non-idempotent, because its strongest capability is. May require an approval and an idempotency key.
No parameter schema in public metadata yet.
broker_request_credentialOpt-in (`BROKER_ALLOW_KEY_REQUESTS=1`). Asks the operator for a key by opening the key manager pre-filled. The agent never sees the page, the token or the key.
Opt-in (`BROKER_ALLOW_KEY_REQUESTS=1`). Asks the operator for a key by opening the key manager pre-filled. The agent never sees the page, the token or the key.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
BROKER_AGENT_ID*Which agent identity this process is. Must be provisioned in the policy file.
BROKER_POLICY_FILEPath to the policy YAML (version 2). Defaults to config/broker.yaml.
BROKER_AUDIT_FILEPath to the content-free audit log. Defaults to data/audit.jsonl.
BROKER_APPROVALS_FILEPath to the approvals file. Defaults to config/approvals.json.
BROKER_HOT_RELOADSet to 1 to pick up key manager changes without a restart. Off by default.
BROKER_ALLOW_KEY_REQUESTSSet to 1 to let this agent ask the operator for a key through the key manager. Off by default.
Readme
Credential Broker MCP
A local-first MCP server that lets AI agents use gated APIs without ever holding the keys.
The agent asks the broker to make a request. The broker canonicalises the URL, checks a declarative per-operation policy, verifies any required approval at execution time, injects the secret at the last moment, calls the upstream, redacts and filters the response, and writes a content-free audit record. The secret lives with the broker process and is never relayed to the agent in any representation the broker creates: raw, hex, Base64, base64url, percent-encoded, form-encoded, or Unicode-normalised. An upstream that transforms a secret with a one-way function of its own defeats string matching; scoped operations and metadata-only responses are the defence there, and SECURITY.md states this boundary honestly.
Details
- Repository
- github.com/sarutobisasuke8/credential-broker-mcp
- Website
- github.com/SarutobiSasuke8/credential-broker-mcp#readme
- Package
@sarutobi-sasuke/credential-broker-mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active