@goldtopcollective/keiko-mcp

MCP (Model Context Protocol) server for Keiko — a secure secrets manager for AI agents.

Keiko injects secrets as environment variables into commands without ever exposing secret values to AI models. Secret values exist only briefly in subprocess memory and are redacted from all output.

Quick Start

1. Add to Claude Code

claude mcp add --transport stdio keiko -- npx -y @goldtopcollective/keiko-mcp

Set the required environment variables:

claude mcp add --transport stdio \
  -e KEIKO_URL=https://your-keiko-instance.example.com \
  -e KEIKO_TOKEN=your-environment-token \
  keiko -- npx -y @goldtopcollective/keiko-mcp

2. Or configure manually

Add to your ~/.mcp.json:

{
  "keiko": {
    "command": "npx",
    "args": ["-y", "@goldtopcollective/keiko-mcp"],
    "env": {
      "KEIKO_URL": "https://your-keiko-instance.example.com"
    }
  }
}

3. Store your token securely (optional)

Instead of putting your token in config files, store it in the OS keychain:

npx @goldtopcollective/keiko-mcp --store-token YOUR_TOKEN

This uses the native OS credential store (Windows Credential Manager, macOS Keychain, or Linux libsecret). The MCP server reads it automatically at startup.

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | KEIKO_URL | Yes | URL of your Keiko backend | | KEIKO_TOKEN | No* | API token for authentication |

* Token can be provided via env var or stored in OS keychain using --store-token.

Available Tools

| Tool | Description | |------|-------------| | run_with_secrets | Run a command with secrets injected as env vars — values never appear in responses | | list_secrets | Search the vault (returns names only, never values) | | add_secret | Create a new secret in the vault | | session_status | Check authentication state | | lock | Emergency kill switch — revoke all active sessions | | set_ttl | Configure session token expiry | | get_guide | Fetch usage guide with examples |

Security Model

• Secret values are never returned in tool responses
• Secrets are injected as environment variables into spawned subprocesses
• All command output is sanitized (exact match, base64, and URL-encoded variants are redacted)
• Communication with the Keiko backend uses HTTPS/TLS
• Tokens can be stored in the OS keychain rather than config files

Requirements

• Node.js >= 20
• A running Keiko backend instance
• An environment token (generated via the Keiko admin UI)

License

MIT