SecureInput

SecureInput — private API key input for AI coding agents

Give an AI coding agent the access it needs without pasting your API key into chat. SecureInput is an open-source, local-first Model Context Protocol (MCP) server for API keys, passwords, and tokens. It collects input in an inline MCP App when the host supports it, or in a paired localhost browser otherwise. It can pass the value to a local command through stdin or environment variables, or write it to a .env file.

The default MCP response contains status and exit information, not the secret. The MCP bridge is designed for stdio clients such as Claude Code, Cursor, Codex, VS Code / GitHub Copilot, Windsurf, and Cline; inline display depends on the host's MCP Apps support. macOS and Linux require Node.js 22 or newer.

[Install](#install) · [Connect your agent](#connect-your-coding-agent) · [Security and trust](docs/security-model.md) · [FAQ](#faq)

Watch the 20-second illustrated overview · Run the real widget with a fake key

agent: "I need a GitHub token to create the repo."

│ ▼ request_secret (MCP) │ ▼ inline form in a compatible host, or paired localhost browser │ ▼ SecureInput daemon on 127.0.0.1 ├── execute: gh auth login --with-token (token through stdin) └── write_env: .env.local (plaintext file, mode 0600) │ ▼ agent: { "ok": true, "status": "completed", "exitCode": 0 }

Why this exists

Coding agents constantly need credentials. The usual options are bad:

SecureInput provides a separate input path for the credential. By default it does not return the value in the MCP tool result. The inline host, commands you run, and applications with access to a written .env file remain part of the trust boundary. See Security model.

Features

• MCP-native — one tool, request_secret, plus polling, cancellation, and status tools.
• Local only — binds to 127.0.0.1; pairing token, signed session cookie, Origin and CSRF checks.
• No secret in chat by default — the agent receives request status and exit details. stdout/stderr are withheld from MCP results.
• Direct command execution — no shell, secrets supplied through stdin or environment variables, never command-line arguments.
• Safe `.env` writes — atomic replace, 0600 permissions, comments and line endings preserved, .env and .env.* only.
• Two input modes — the compact inline form submits on Enter; the paired browser offers request details and additional confirmations for risky actions.
• One-time requests — pending requests expire, results are short-lived, and a submission can only be claimed once.
• Defense in depth — RE2-safe validation patterns, value/output size caps, ANSI stripping, output redaction, audit metadata without values.
• Small shadcn/ui frontend — the UI is intentionally boring: pairing, a request list, a form, and a result.
• Opt-in return mode — for clients that truly need the value back; disabled by default and clearly marked dangerous.

Requirements

• Node.js 22 or newer
• macOS or Linux (Windows is supported in code but not yet covered by CI)
• An MCP Apps-compatible host, or a browser on the same machine for fallback

Install

Claude Desktop: download the bundle

1. Download secureinput-release-0.1.0.mcpb from GitHub Releases. This bundle is unsigned; review the source and release before installing it.
2. In Claude Desktop, open Settings → Desktop app → Manage next to Extensions (or Settings → Extensions in older versions), then Advanced settings → Install Extension… and select the downloaded file. Availability can depend on your organization's settings. See Claude's installation guide.
3. Check that SecureInput is connected in Claude's connectors or extensions settings, then ask for a test using a fake key. Inline input depends on host support; otherwise use the paired local browser.

The bundle requires a Node.js 22-compatible runtime and supports macOS and Linux. This is a directly downloaded bundle, not an official Claude directory listing. To update it, download and install a newer bundle; a GitHub push does not update an installed copy automatically.

Install from source

The npm package is not published. Install from this repository, or download the MCP bundle from GitHub Releases for an MCPB-compatible client. The bundle requires Node.js 22 or newer and is currently unsigned.

git clone https://github.com/r69shabh/secureinput.git

cd secureinput npm ci npm run build npm link # puts secureinput on your PATH

Add SecureInput to your MCP client. The first client connection starts the local daemon automatically. To start it yourself and pair the browser fallback:

secureinput serve

Inline requests do not open a browser. When a client needs the browser fallback, its pairing page opens automatically if browser opening is enabled. You can also open and pair it manually:

secureinput pair

You can also check that everything is healthy:

secureinput status

secureinput doctor

The daemon listens on http://127.0.0.1:4780. The config lives in ~/.secureinput/ with mode 0600.

npm link is just for local use. npm install -g . or an absolute path to dist/cli/index.js works too.

Browser or inline input

When the local inline widget is rebuilt, a connected SecureInput server announces the updated resource automatically. Clients that honor MCP tool-list change notifications can use the new form for subsequent requests without reconnecting; already-open forms keep their original version. Some clients may need a reconnect if they do not refresh tool metadata. Installing this refresh capability itself requires restarting the existing MCP process once.

A GitHub push does not install updates on users' computers: update the local checkout and rebuild it first. The refresh mechanism updates the widget only; changes to the running server or daemon may still require a restart. SecureInput does not silently download or execute updates.

Inline input is the default on compatible MCP Apps clients. If the client cannot render it, SecureInput automatically opens paired localhost browser input. No browser is opened for supported inline requests, and Enter authorizes the requested delivery without an additional SecureInput confirmation dialog. The host may still apply its own MCP tool permissions.

Existing explicit browser-only preferences are preserved. To switch an existing installation to inline-first:

secureinput settings --input-mode inline

secureinput stop

Reconnect your MCP clients to apply a changed setting. Use secureinput settings --input-mode browser only if you want to force browser input.

Inline requires a host advertising the MCP Apps HTML capability. Text-only clients automatically use the browser. Both modes deliver to the same local execute or write_env implementation. The inline form shows only the field label and a rounded outline input with an inset submit arrow. In inline mode, Enter authorizes the requested delivery, including an overwrite explicitly requested by the agent; the browser flow keeps its separate review controls. The inline form encrypts values and a one-request capability with AES-256-GCM; a fresh RSA-OAEP-SHA-256 key pair wraps the encryption key. Only the daemon holds the private key. The capability and public key are supplied in widget-only tool-result metadata; the host must keep that metadata out of model context. Inline return-to-agent delivery is unsupported and uses the browser instead.

The inline widget needs no direct network access: it submits ciphertext through the host's MCP bridge. This does not protect against a malicious host that alters widget code or keys. The local browser retains a stronger boundary from the chat host. Neither mode sandboxes an approved command's filesystem or network access, and no “never trained” claim follows from merely using terminal commands.

For a synthetic local test of the actual widget and terminal-to-env flow:

npm run build

npm run demo:host

Open the printed loopback URL and submit a fake key. The reference host renders the real MCP App inside a restricted iframe; the demo Node command writes .env.inline-demo with mode 0600 in an isolated temporary directory. The compact inline form does not display the command for review. This reference host is a test fixture, not proof that a particular chat product supports inline apps. Use real credentials only in a separately evaluated host.

Connect your coding agent

SecureInput runs as a stdio MCP bridge. The first client that needs it auto-starts the shared daemon; you only pair the browser once.

Claude Code

claude mcp add secureinput -- secureinput mcp

Run claude mcp list to check the connection. Add --scope user before secureinput if you want the configuration available across projects.

Cursor

Add to ~/.cursor/mcp.json (or the project .cursor/mcp.json):

{

"mcpServers": { "secureinput": { "command": "secureinput", "args": ["mcp"] } } }

Codex CLI

Register the server using the Codex CLI:

codex mcp add secureinput -- secureinput mcp

codex mcp list

Alternatively, add to ~/.codex/config.toml:

[mcp_servers.secureinput]

command = "secureinput" args = ["mcp"]

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

{

"servers": { "secureinput": { "type": "stdio", "command": "secureinput", "args": ["mcp"] } } }

Any MCP client

Use a stdio server with command secureinput and argument mcp.

{

"mcpServers": { "secureinput": { "command": "secureinput", "args": ["mcp"] } } }

If the executable is not on PATH, use the absolute path to dist/cli/index.js:

{

"mcpServers": { "secureinput": { "command": "node", "args": ["/absolute/path/to/secureinput/dist/cli/index.js", "mcp"] } } }

Add an instruction like this to your agent rules so it reaches for the tool instead of asking for a pasted key:

When you need an API key, password, or token, call the SecureInput MCP tool

request_secret. Do not ask me to paste secrets into chat. Prefer delivery mode "execute" with the secret in stdin/env, or "write_env" for .env files.

MCP tools

request_secret

Creates a secure input request and optionally waits for the user.

{

"title": "GitHub CLI login", "description": "Authenticate gh so I can create and push the repository.", "fields": [ { "id": "token", "label": "GitHub token", "description": "A fine-grained token with repo access.", "type": "password", "minLength": 20 } ], "delivery": { "mode": "execute", "command": "gh", "args": ["auth", "login", "--with-to