Keymaster Mcp
Let coding agents fetch runtime secrets from HashiCorp Vault through a read-only Keymaster proxy without pasting keys into chat.
Overview
Keymaster MCP is a MCP server for the Build phase that provides read-only runtime secret retrieval from HashiCorp Vault via Keymaster for agents.
What is this MCP server?
- Read-only secret retrieval from HashiCorp Vault via Keymaster proxy (npm @akari-os/keymaster-mcp 1.0.2).
- Bearer USER_KEYMASTER_TOKEN authentication to USER_KEYMASTER_URL.
- stdio transport for local agent hosts.
- Scoped for autonomous agents that need runtime credentials without write access to Vault.
- GitHub source: AInoAKARI/keymaster-mcp.
- Server version 1.0.2
- npm package identifier: @akari-os/keymaster-mcp
- Two required env vars: USER_KEYMASTER_URL, USER_KEYMASTER_TOKEN
Community signal: 1 GitHub stars.
What problem does it solve?
Autonomous coding agents need API keys during integration work, but dropping Vault secrets into prompts or repos creates leak and blast-radius risk.
Who is it for?
Indie devs with Vault plus Keymaster already running who want MCP-gated secret reads for agent-driven integration tasks.
Skip if: Builders without Vault/Keymaster infra, or teams that need agents to write or rotate secrets rather than read them.
What do I get? / Deliverables
After configuration, agents fetch allowed secrets through Keymaster at runtime with read-only MCP access instead of embedding credentials in code or chat.
- Agent-callable read-only secret fetch from Vault via Keymaster
- Reduced secret exposure in chat and committed config files
- stdio MCP wiring documented in server.json and GitHub repo
Recommended MCP Servers
Journey fit
Secret retrieval MCP is wired during Build when you connect agents to staging APIs, deploy pipelines, and third-party services. Integrations is the canonical shelf for MCP bridges to external infra like Vault proxies, distinct from running production monitoring.
How it compares
Read-only Vault proxy MCP, not a secrets scanner skill or broad cloud IAM admin plugin.
Common Questions / FAQ
Who is Keymaster MCP for?
Solo builders and small teams using HashiCorp Vault with a Keymaster proxy who want MCP agents to load secrets safely during development workflows.
When should I use Keymaster MCP?
Use it when integrating services or running agent-led deploy tasks that need short-lived or path-scoped secrets without copying them into the IDE.
How do I add Keymaster MCP to my agent?
Install npm package @akari-os/keymaster-mcp 1.0.2, configure stdio MCP, and set USER_KEYMASTER_URL and USER_KEYMASTER_TOKEN as required environment variables.