@seekrit/mcp

The seekrit MCP server, as a standalone npx-able package — so an AI agent (Claude Code, or any MCP client) can provision, manage, and inject end-to-end encrypted secrets with zero prior install.

seekrit is zero-knowledge: secret values, data keys, and private keys never reach the server. Decryption only ever happens where the credential lives, so this MCP server runs on your machine, next to the credential — everything that produces plaintext (a secret value, a data key, a decryption-capable grant) stays on the client. It is the crypto plane of seekrit's two-server design.

This package is a thin entrypoint around the exact same server as the seekrit mcp subcommand of @seekrit/cli; it just publishes it as its own binary so no CLI install is required first.

Setup

Add it to any MCP client with a stdio server whose command runs this package via npx, passing a credential in its environment.

Fully autonomous agent (recommended). An agent with no account can sign up for machine credentials (POST https://mcp.seekrit.dev/signup) and use the same client id + secret for everything — the hosted metadata plane and this local crypto plane. Point this server at them and it mints its own admin token automatically on first use (keyless — the keypair is generated locally), so there is no token to copy:

{
  "mcpServers": {
    "seekrit": {
      "command": "npx",
      "args": ["-y", "@seekrit/mcp"],
      "env": {
        "SEEKRIT_CLIENT_ID": "<your client id>",
        "SEEKRIT_CLIENT_SECRET": "<your client secret>"
      }
    }
  }
}

With an existing token. If you already hold a service token, pass it directly. For Claude Code:

# An admin token lets the agent provision structure (apps/envs/tokens) too:
claude mcp add seekrit --env SEEKRIT_TOKEN=skt_… -- npx -y @seekrit/mcp

{
  "mcpServers": {
    "seekrit": {
      "command": "npx",
      "args": ["-y", "@seekrit/mcp"],
      "env": {
        "SEEKRIT_TOKEN": "skt_…"
      }
    }
  }
}

Requires Node ≥ 20. Set SEEKRIT_API_URL too if you're not on the hosted API.

As a container

For a sandbox with no Node toolchain, the same server ships as a multi-arch Docker image, seekritdev/mcp. Register a stdio server that runs docker run -i — the -i is required, since stdin is the MCP transport:

{
  "mcpServers": {
    "seekrit": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "SEEKRIT_TOKEN",
        "-v", "${PWD}:/work",
        "seekritdev/mcp"
      ]
    }
  }
}

The bare -e SEEKRIT_TOKEN forwards the token from the client's environment. Mount a workdir at /work for the run_command tool to operate on (it runs inside the container). Pin a release (seekritdev/mcp:0.2.0) or track :edge. The container still decrypts locally — nothing plaintext leaves it.

Choosing the credential

The server authenticates exactly like the CLI — SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET, SEEKRIT_TOKEN, or saved config at ~/.config/seekrit/config.json.

| Credential | Good for | Notes | | --- | --- | --- | | Machine credentials (SEEKRIT_CLIENT_ID + SEEKRIT_CLIENT_SECRET) | Fully autonomous agents: one credential for both planes | Auto-mints + caches an admin token on first use. Get them from POST /signup. | | Admin token (seekrit token create --admin) | Provisioning: create apps/groups/envs, compose, grant, mint tokens | Org-scoped; a fixed headless credential for structure. | | Runtime token (bound to an env) | Reading/writing/injecting one environment's secrets | Self-decrypts — no passphrase. Cannot provision. |

Under user auth (no token), tools that decrypt need SEEKRIT_PASSPHRASE in the server's environment — there is no TTY to prompt on.

Using secrets without exposing them

Prefer the run_command tool: it injects the resolved secrets into a child process and returns only its output, so plaintext never enters the agent's context. get_secret returns metadata by default and only decrypts when you pass reveal: true.

See the AI agents guide for the full tool list and a typical session.