SecureInput

SecureInput

Your agent needs the token. It doesn't need to see it.

SecureInput is an open-source, local-first MCP server for API keys, passwords, and tokens. When your coding agent needs a credential, you type it into a small input that appears inside the chat, styled like the host's own composer. The value goes straight to a local command (stdin or env) or a .env file. The agent only gets back { "ok": true, "status": "completed", "exitCode": 0 }.

Works with Claude Code, Claude Desktop, Cursor, Codex, VS Code / GitHub Copilot, Windsurf, Cline, and any stdio MCP client. macOS and Linux, Node.js 22+.

[Install](#install) · [How it works](#how-it-works) · [Security model](docs/security-model.md) · [FAQ](#faq) · Watch the 20-second overview

Install

Pick your client. Every option runs npx -y secureinput mcp (Node.js 22+), which starts the shared local daemon on first use. Try it with a fake key first.

1. Connect your agent

Claude Code

claude mcp add --scope user secureinput -- npx -y secureinput mcp

claude mcp list # secureinput: ✔ Connected

</details>

Claude Desktop : one-file bundle, no terminal

1. Download the latest secureinput-release-*.mcpb from GitHub Releases. The bundle is unsigned; review the release before installing.
2. Open Settings → Desktop app → Manage next to Extensions (older versions: Settings → Extensions), then Advanced settings → Install Extension… and pick the file. See Claude's guide.
3. Ask Claude to save a fake key with SecureInput.

To upgrade, install the newer .mcpb.

Cursor : use the button above, or ~/.cursor/mcp.json

{ "mcpServers": { "secureinput": { "command": "npx", "args": ["-y", "secureinput", "mcp"] } } }

VS Code / GitHub Copilot : use the button above, or .vscode/mcp.json

{ "servers": { "secureinput": { "type": "stdio", "command": "npx", "args": ["-y", "secureinput", "mcp"] } } }

Codex CLI

codex mcp add secureinput -- npx -y secureinput mcp

Or in ~/.codex/config.toml:

[mcp_servers.secureinput]

command = "npx" args = ["-y", "secureinput", "mcp"]

</details>

Windsurf, Cline, or any stdio client

{ "mcpServers": { "secureinput": { "command": "npx", "args": ["-y", "secureinput", "mcp"] } } }

Global install or from source

npm install -g secureinput     # then use command "secureinput", args ["mcp"]

secureinput doctor # checks Node, config and the daemon

From source: git clone https://github.com/r69shabh/secureinput.git && cd secureinput && npm ci && npm run build && npm link.

GUI apps may not see a Node version manager's PATH (fnm, nvm, volta). If npx isn't found, use the full path from realpath "$(which npx)" as the command.

2. Tell your agent to use it

Add this to your agent rules (CLAUDE.md, AGENTS.md, .cursor/rules, …) so it reaches for the tool instead of asking you to paste:

When you need an API key, password, or token, call the SecureInput MCP tool

request_secret. Do not ask me to paste secrets into chat. Prefer delivery mode "execute" with the secret in stdin/env, or "write_env" for .env files.

How it works

agent: "I need a GitHub token to create the repo."

│ request_secret (MCP) ▼ input inside the chat (MCP Apps hosts) ─or─ paired page on 127.0.0.1 │ encrypted to the local daemon ▼ SecureInput daemon on 127.0.0.1 ├── execute: gh auth login --with-token (token through stdin) └── write_env: .env.local (mode 0600) │ ▼ agent: { "ok": true, "status": "completed", "exitCode": 0 }

Feels native in every host

On hosts that support MCP Apps, the input renders inline in the conversation and adopts the host's own theme, fonts, colours, corner radii, and focus ring from the design tokens the host provides. In Claude it looks like Claude's composer; in a dark-mode client it's dark. Hosts that send no tokens get a neutral light/dark fallback. Press Enter to submit; there is no extra SecureInput dialog.

Text-only clients automatically fall back to a paired page on 127.0.0.1, which also shows the destination and a risk review before anything runs. Force it with secureinput settings --input-mode browser.

What stays out of the chat

SecureInput keeps the value out of the MCP result, but the commands you approve, the host that renders the inline form, and anything that can read a written .env file are still trusted. Read the security model before using real credentials.

Features

• One MCP tool: request_secret, plus check, cancel, and status tools.
• Local only: binds 127.0.0.1; pairing token, signed session cookie, Origin and CSRF checks.
• No secret in results by default: the agent sees status and exit code; stdout/stderr are withheld.
• Direct execution: no shell; secrets through stdin or env, rejected in command arguments.
• Safe `.env` writes: atomic replace, 0600, comments and line endings kept, .env / .env.* only, no overwrites unless requested.
• Encrypted inline submission: AES-256-GCM, key wrapped with a fresh RSA-OAEP key pair held only by the daemon.
• Allowed roots: commands and .env files must sit inside your allowed folders (home by default).
• Defense in depth: RE2-safe patterns, size caps, ANSI stripping, output redaction, audit log without values.
• Opt-in return mode: for clients that truly need the value back; off by default and marked dangerous.

Inline input details

The inline form encrypts values and a one-request capability with AES-256-GCM; a fresh RSA-OAEP-SHA-256 key pair wraps the encryption key, and only the daemon holds the private key. The capability and public key travel in widget-only tool-result metadata, which the host must keep out of model context. The widget needs no network access: it submits ciphertext through the host's MCP bridge. This does not protect against a malicious host that alters widget code or keys; the browser mode keeps a stronger boundary from the chat host. Neither mode sandboxes an approved command.

When you rebuild the widget, a connected server announces the new version; clients that honour tool-list change notifications pick it up without reconnecting. Server or daemon changes still need a restart. SecureInput never downloads or runs updates on its own.

Try the real widget with a fake key in a reference host:

npm run build

npm run demo:host

Open the printed loopback URL and submit a fake key. The demo writes .env.inline-demo with mode 0600 in a temporary directory. The reference host is a test fixture, not proof that a particular chat product supports inline apps.

Useful commands: secureinput status, secureinput doctor, secureinput pair (browser fallback), secureinput stop. The daemon listens on http://127.0.0.1:4780; config lives in ~/.secureinput/ with mode 0600.

MCP tools

request_secret

Creates a secure input request and optionally waits for the user.

{

"title": "GitHub CLI login", "description": "Authenticate gh so I can create and push the repository.", "fields": [ { "id": "token", "label": "GitHub token", "description": "A fine-grained token with repo access.", "type": "password", "minLength": 20 } ], "delivery": { "mode": "execute", "command": "gh", "args": ["auth", "login", "--with-token"], "stdin": "{{token}}", "timeoutSeconds": 60 }, "waitSeconds": 30 }

Fields:

• title — short request name, max 100 characters.
• description — why the secret is needed, max 1000 characters.
• cwd — optional working directory, resolved relative to the MCP client's working directory; must resolve inside an allowed root.
• fields — 1–10 inputs. Each has id, label, optional description, type (password or text), placeholder, minLength, maxLength, pattern (RE2), required, sensitive, and autocomplete.
• delivery — execute, write_env, or return (disabled by default).
• timeoutSeconds — request lifetime, 30–900 seconds. Default 300.
• waitSeconds — how long this tool call blocks, 0–240 seconds. Default 30.

If the user has not submitted within waitSeconds, the result is { "requestId": "req_…", "status": "pending", "inputMode": "inline" } (or "browser"). Call check_secret_request with the returned request ID.

check_secret_request

Long-polls an existing request. Waits up to 45 seconds.

{ "requestId": "req_…", "waitSeconds": 30 }

cancel_secret_request

Cancels a request that is still pending.

{ "requestId": "req_…" }

secureinput_status

Returns input mode, return-mode state, and pending request IDs/statuses. Full browser/API policy responses are unchanged.

Delivery modes

execute — run a command with the secret

{

"mode": "execute", "command": "gh", "args": ["auth", "login", "--with-token"], "cwd": ".", "stdin": "{{token}}", "env": {}, "timeoutSeconds": 120 }

• The command is spawned directly with shell: false. There is no shell interpolation by SecureInput.
• Secret fields can appear in stdin or env values as {{fieldId}}. They cannot appear in command or args. Environment variables can still be visible to other processes on some systems; prefer stdin when available.
• Non-sensitive text fields may be used in args for things like usernames.
• At least one secret reference must go through stdin or env.
• stdout and stderr are withheld from the agent. The paired local browser can show size-capped, best-effort redacted output.
• Child processes receive basic OS variables (such as PATH, HOME and temporary-directory settings), fixed terminal settings, a