Keyfold MCP server
Commit Oct 20, 2026Allows AI agents to use API keys from an encrypted vault without exposing the secrets to the model.
Also known as codewithkolin/keyfold
- Stars
- 0
- Tools
- —
- Downloads, 30 days
- —
- Latest version
- 1.0.1
- Last commit
- Oct 20, 2026
- License
- AGPL-3.0
What is Keyfold MCP?
Keyfold allows AI agents to use API keys from an encrypted vault without exposing the secrets to the model.
Summary generated from the project's README
About Keyfold MCP server
Providing API keys to AI agents without exposing the actual secret values to the language model is what Keyfold enables. This MCP server connects to the Keyfold desktop application on macOS to allow clients like Claude Code and Cursor to access an encrypted, offline-first vault. It uses a local socket protocol to communicate between the CLI and the running app, ensuring that no sensitive data is sent directly to the model during the request process.
Developers use the seven available tools to manage projects, store new keys, or import existing .env files. Instead of returning secrets, the tools perform actions like writing an approved .env file or running a command with injected credentials. Every single request requires manual approval through a click in the Keyfold app, which displays exactly what command or file is being accessed. This setup keeps your Argon2id and XChaCha20-Poly1305 encrypted data local to your machine without requiring a cloud account or telemetry.
What you can do with it
- 1Inject keys into commandsAsk your AI agent to run a specific terminal command using credentials stored in your vault.
- 2Generate environment filesHave an AI client create a .env file containing your project secrets after you provide manual approval.
- 3Manage vault organizationInstruct an agent to create new projects or import existing environment configurations into your encrypted vault.
- 4Secure credential accessUse an AI agent to list available keys and projects without the model ever seeing the actual secret strings.
Written from the project's README. Every use case is checked against a quote from it.
Automated checks
Ran Nov 14, 2026Full report →Not verified yet. A server needs a score of 80, no serious finding, and enough data for us to check. How checks work · What to fix for more points
- Source repository linked and reachablecodewithkolin/keyfold is public and reachablegithub.com/codewithkolin/keyfold ↗Pass
- Package names this repository as its sourceNot checked
- Build provenance (Sigstore attestation)Not checked
- Open source license (OSI)AGPL-3.0spdx.org/licenses/AGPL-3.0.html ↗Pass
- Commit or release in the last yearLast commit or release 2026-10-20github.com/codewithkolin/keyfold ↗Pass
- OpenSSF ScorecardNot checked
- Package name not close to a popular packageNot checked
- No critical advisory in the package or its dependenciesNot checked
- No hidden instructions to the model0 tool descriptions and the README read; no override phrases, credential paths or hidden charactersPass
- Destructive tools are labelledNot checked
- Remote endpoint answers the MCP handshakeNot checked
README
View on GitHubKeyfold core
The open-source parts of Keyfold, an offline-first vault for developers: API keys organised by project and environment, plus passwords, in one encrypted file. No account, no cloud, no telemetry.
The Keyfold app for Mac is built on these crates (Windows is coming through the Microsoft Store). Get it at keyfold.app/download; signed builds are also on the Releases page.
What is here
| Crate | What it does |
|---|---|
crates/keyfold-core |
Argon2id key derivation, XChaCha20-Poly1305 envelope encryption, the tamper-evident vault format, rolling backups, the Recovery Kit, .env parsing, key detection patterns, 2FA codes (RFC 6238) and offline Ed25519 licence verification |
crates/keyfold-agent |
The JSON-line protocol between the keyfold CLI and the running app, over an owner-only local socket |
crates/keyfold-cli |
The keyfold command line and the MCP server for Cursor and Claude Code. No tool returns a secret value; every request is approved in the app |
Use it with an AI agent (MCP)
keyfold mcp lets Claude Code, Cursor, Codex, Gemini CLI and other MCP clients use your API keys without the model seeing them. Its seven tools list project and key names, write a .env file you approve, run a command with the keys injected, store a key, create a project and import a .env file. None of them returns a secret value. Every request waits for your click in the Keyfold app, which shows the command or file the keys are for.
- Install Keyfold for Mac. In the app, open Settings › General › Command line and MCP and click Install, which puts
keyfoldon yourPATH. - Add the server to your client:
claude mcp add --scope user keyfold -- keyfold mcp
Cursor (.cursor/mcp.json): { "mcpServers": { "keyfold": { "command": "keyfold", "args": ["mcp"] } } }
A command you approve can still print a key, and the model reads what it prints; the MCP guide covers that and one-hour approvals. The server needs the Keyfold app running and unlocked on the same Mac. The Dockerfile builds it on Linux only so that MCP directories can read its tool list.
MCP Registry name: mcp-name: io.github.codewithkolin/keyfold
Docs
- Vault format: every byte of the file, and how it is authenticated.
- Threat model: what Keyfold protects against, and what it cannot.
- MCP and CLI guide: connecting an AI agent without showing it your keys.
Build and test
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo build --release -p keyfold-cli # the `keyfold` binary
Rust stable, no other toolchain needed.
Security
Please report vulnerabilities privately; see SECURITY.md.
Licence
AGPL-3.0-only. See the LICENSE file in each crate. The Keyfold desktop app around these crates is proprietary.
Keyfold MCP questions
How are requests from the AI agent authorized?
Every request made by the MCP server requires manual approval via a click in the Keyfold desktop app.
What platforms are supported?
The Keyfold app is currently available for Mac, with a Windows version coming through the Microsoft Store.
What can the MCP tools actually do?
The tools can list projects and keys, write approved .env files, run commands with injected keys, store keys, create projects, and import .env files.