Crypt Keeper MCP v0.2

MCP server for secure secret management with ACMI audit mirroring and cross-process secret propagation

Part of the IBM BOB Hackathon 2026-05 submission (Lane B) by Mad EZ Media.

Features

• 🔐 Secure secret propagation across process boundaries
• 📊 ACMI audit mirroring for all secret operations
• ⏱️ TTL-based expiration for time-limited secrets
• 🎯 Scope control: session, process, or global secrets
• 🔍 SHA-256 hashing for audit trail (value never logged)
• 🛡️ Zero-trust architecture with explicit propagation

Installation

npm install @madezmedia/crypt-keeper-mcp

Configuration

Add to your MCP settings (e.g., .bob/mcp.json for Bob Shell):

{
  "mcpServers": {
    "crypt-keeper": {
      "command": "npx",
      "args": ["@madezmedia/crypt-keeper-mcp"],
      "env": {
        "ACMI_AUDIT_ENABLED": "true"
      }
    }
  }
}

Usage

Basic Secret Propagation

// Propagate OpenAI API key with session scope
{
  "key": "OPENAI_API_KEY",
  "value": "sk-proj-...",
  "scope": "session",
  "ttl": 3600
}

Process-Scoped Secret

// Propagate Stripe key for current process tree
{
  "key": "STRIPE_SECRET_KEY",
  "value": "sk_live_...",
  "scope": "process",
  "metadata": {
    "agent_id": "payment-processor",
    "purpose": "checkout-flow"
  }
}

Global Secret with Metadata

// Propagate Anthropic key system-wide
{
  "key": "ANTHROPIC_API_KEY",
  "value": "sk-ant-...",
  "scope": "global",
  "ttl": 86400,
  "metadata": {
    "agent_id": "claude-engineer",
    "correlation_id": "cryptKeeperGlobalSecret-1779007900000"
  }
}

Tool Reference

secret_propagate

Safely propagate a secret across process boundaries with ACMI audit mirroring.

Parameters:

| Name | Type | Required | Default | Description | |------|------|----------|---------|-------------| | key | string | ✅ | - | Secret key identifier (e.g., OPENAI_API_KEY) | | value | string | ✅ | - | Secret value (redacted in audit logs) | | scope | enum | ❌ | session | Secret scope: session, process, or global | | ttl | number | ❌ | - | Time-to-live in seconds | | metadata | object | ❌ | {} | Optional metadata for audit trail |

Returns:

{
  "success": true,
  "key": "OPENAI_API_KEY",
  "scope": "session",
  "ttl": 3600,
  "stored_at": "2026-05-16T04:15:00.000Z",
  "audit_event_id": "evt-1779007900000-abc123",
  "expires_at": "2026-05-16T05:15:00.000Z"
}

ACMI Integration

All secret operations emit audit events to ACMI timeline:

{
  "namespace": "agent",
  "id": "crypt-keeper-mcp",
  "source": "crypt-keeper-mcp",
  "kind": "secret-propagate",
  "summary": "[secret-propagate] key=OPENAI_API_KEY scope=session ttl=3600 hash=a1b2c3d4",
  "correlationId": "cryptKeeperSecretPropagate-1779007900000",
  "metadata": {
    "key": "OPENAI_API_KEY",
    "scope": "session",
    "ttl": 3600,
    "redacted_value_hash": "a1b2c3d4"
  }
}

Security Note: Secret values are NEVER logged. Only SHA-256 hashes appear in audit trails.

Scope Behavior

| Scope | Storage | Lifetime | Use Case | |-------|---------|----------|----------| | session | In-memory | Current session | Single-agent workflows | | process | process.env | Current process tree | Multi-tool coordination | | global | System keychain | System-wide | Cross-agent secrets |

Development

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

# Watch mode
npm run dev

Architecture

┌─────────────────────────────────────────────────────────────┐
│                     Crypt Keeper MCP v0.2                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌──────────────┐      ┌──────────────┐                   │
│  │ MCP Server   │─────▶│ Secret Store │                   │
│  │ (stdio)      │      │ (scoped)     │                   │
│  └──────────────┘      └──────────────┘                   │
│         │                                                   │
│         │                                                   │
│         ▼                                                   │
│  ┌──────────────┐      ┌──────────────┐                   │
│  │ ACMI Audit   │─────▶│ Timeline     │                   │
│  │ Integration  │      │ Events       │                   │
│  └──────────────┘      └──────────────┘                   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Related Projects

• @madezmedia/acmi-mcp - ACMI Communication Standard v1.1
• Lobster Trap Phase 2 - Git Guardian DENY rules

License

MIT © Mad EZ Media

Contributing

This project is part of the IBM BOB Hackathon 2026-05 submission. Contributions welcome after hackathon completion.

Acknowledgments

Built with:

• @modelcontextprotocol/sdk - MCP TypeScript SDK
• IBM Bob Shell - AI coding assistant
• ACMI Communication Standard v1.1

Hackathon Context: This MCP server defends against the PromptArmor-class vulnerability disclosed in IBM Bob by providing auditable secret propagation with zero-trust architecture. Every secret operation is logged to ACMI timeline, enabling post-hoc governance review and meta-recursive proof (audit-log-as-artifact pattern).