keyshroud

Name: keyshroud
Author: dinhkarate

作者：dinhkarate版本 0.8.0i★ –i在你的电脑上运行

注册名称io.github.dinhkarate/keyshroud

安装

概览

作者提供的说明（英文原文）

Agent-safe secrets (local encrypted vault or Vaultwarden): injected into commands, masked in output

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i起步阶段↓ 469/周 · ★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 网络安全

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
注册中心没有列出需要填写的密钥。

你需要

npm已安装 Node.js（用于 npx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "keyshroud": {
      "command": "npx",
      "args": [
        "-y",
        "keyshroud",
        "mcp"
      ]
    }
  }
}

在终端中运行这条命令

claude mcp add keyshroud -- npx -y keyshroud mcp

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "keyshroud": {
      "command": "npx",
      "args": [
        "-y",
        "keyshroud",
        "mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "keyshroud": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "keyshroud",
        "mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 dinhkarate 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“网络安全”中的其他服务器比较i

星标数多于此分类中其他 1000 个服务器的 0%
发布到注册中心的时间比此分类中其他 1000 个服务器的 87% 更新
基础检查结果等于或优于此分类中其他 1000 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

keyshroud 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.8.0）于5天前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。

有什么可以替代它？

同一分类中有：Phishnoo Sandbox, Zovo Dependency Audit, TeamOnly

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Phishnoo Sandbox

Explore synthetic security awareness metrics and file example threat reports.

作者：api.phishnoo.nl起步阶段今天更新

在云端运行✓ api.phishnoo.nl

安装

Zovo Dependency Audit

Audit a dependency list for known vulnerabilities, licenses and outdated versions.

作者：theluckystrike起步阶段今天更新

在云端运行

安装

TeamOnly

Deploy AI-built internal apps behind your company login, with a database, files and secrets.

作者：sohelsd非常新↓ 315/周今天更新

在你的电脑上运行✓ teamonly.dev

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

Your agents use the keys. They never see them.

Keep API keys out of Claude Code, Codex, Cursor, Cline, OpenCode, Gemini CLI, pi and omp — secrets stay in an encrypted vault on your machine (or in your own Vaultwarden or Bitwarden, to share them between machines), and every value is masked before the model reads it.

🚀 Quickstart · 🔐 Local vault · 🔄 Sync with Vaultwarden · 🔌 Supported agents · ⚙️ How it works · ❓ FAQ · 🛡️ Security model · 🌐 Website

🇻🇳 Tiếng Việt · 🇨🇳 简体中文 · 🇯🇵 日本語

$ keyshroud run --mask -- sh -c 'echo "deploying with $GH_TOKEN"; gh api user -q .login'

deploying with dinhkarate

The command got the real token. The transcript — and the model reading it — got . (Masking is automatic when an agent runs the command; --mask forces it in a human terminal.)

Why keyshroud?

Coding agents need credentials to do real work: gh, npm publish, cloud CLIs, webhooks, databases. The usual options are bad:

❌ Paste the key into the chat — now it is in the transcript, the provider's logs, and every future context window
❌ Put it in `.env` — the agent cats it while debugging, or commits it
❌ Pay for a secrets manager — op run needs a 1Password subscription, and most "agent vaults" are hosted SaaS
❌ Use a vault MCP server — most of them return the plaintext value straight to the model

keyshroud fixes this:

✅ Names, not values — agents see GH_TOKEN and local://GitHub token, never the token
✅ Masked output — any value that reaches stdout/stderr becomes
✅ Nothing to set up — an encrypted vault file with its key in your OS keychain; no account, no server
✅ Sync if you want it — Vaultwarden on a $5 VPS or a Raspberry Pi, or Bitwarden, for several machines
✅ Free — MIT-licensed, no telemetry

Features


🙈 Masked output	`keyshroud run` replaces every secret value in stdout/stderr with — streaming-safe across chunk boundaries.
🔐 Local vault	An AES-256-GCM file whose key is in the macOS keychain, the Linux Secret Service or Windows DPAPI (a passphrase where there is none). No account, no server, no `bw`.
🪝 Agent hooks	The pi/omp `tool_result` hook redacts every tool result, failed ones included. Claude Code's `PostToolUse` hook redacts every successful tool result (Bash, Read, Grep, MCP…) — see limits.
🔌 MCP server	For clients without a shell: `keyshroud mcp` gives them `secrets_run`, `secrets_list`, `secrets_request`, `vault_status`. No tool ever returns a value.
🔗 Committable references	`local://item`, `bw://item`, `bw://item/username`, `bw://item/fields/name`, `bw://item/totp` in `.env.refs` files and templates: names, not values.
⌨️ Paste-to-create	New secrets go through a masked prompt in the user's terminal or a masked popup in pi — never through the chat.
📄 `inject`	Render `{{ local://… }}` and `{{ bw://… }}` templates into `0600` config files for tools that can't read env vars (`.npmrc`, kubeconfig).
🔎 `scan`	Find vault values that leaked into your working tree (pre-commit friendly).
⚡ Fast	The local vault answers in milliseconds, offline. With Vaultwarden: one batched `bw list items` per session instead of one `bw get` (~3 s) per secret.
🔄 Optional sync	Vaultwarden on a $5 VPS or a Raspberry Pi, or Bitwarden, when the same secrets should reach several machines. `local://` and `bw://` references work side by side.
🧾 Audit log	`audit.jsonl` records which names were used, when, by which command. Never values.

Supported agents

Agent	Install	What you get
Claude Code	plugin	SessionStart + PostToolUse redaction hooks, skill
pi / omp	`pi install npm:keyshroud`	env hydration, `tool_result` redaction (failed calls too), `/secret`
Codex, OpenCode, Gemini CLI, Cursor agent	`npx skills add dinhkarate/keyshroud`	skill + CLI with masked output
Claude Desktop, chat-only clients	`mcpServers` JSON	MCP tools with masked output
Any shell or CI	`keyshroud run --`	env injection + masked output

Agents with a shell use the CLI: it costs no tool schemas in the context, and keyshroud run masks output whatever the exit code. The MCP server is for clients that cannot run commands.

Use cases

"Claude Code keeps reading my `.env`." Run keyshroud import to move the values into the vault and write a .env.refs file with lines like GH_TOKEN=local://myapp GH_TOKEN, then start the agent with keyshroud run --env-file .env.refs -- claude. The plugin's hooks mask anything that still slips into a tool result.

"I already self-host Vaultwarden." Log bw in to it and run keyshroud doctor: a machine with a bw login keeps Vaultwarden as the default, and keyshroud adds no server of its own.

"I like `op run` but don't want 1Password." keyshroud run is the same idea — references in, masked output out — with the vault on your machine or on a server you host.

"My agent needs to add a new key." It runs keyshroud add or calls secrets_request (MCP), and a hidden-input dialog pops up on your desktop; in pi it is /secret. You paste the value there. It never enters the chat.

Quickstart

Requirements: Node.js ≥ 22.18. Nothing else: no account, no server.

npm install -g keyshroud

1. Store a secret — typed into a masked prompt, never echoed.

The first one creates the local vault.

keyshroud add --env GH_TOKEN --item "GitHub token"

2. Use it

keyshroud run -- gh auth status keyshroud run -- claude # start an agent with every wired secret available

3. Check everything

keyshroud doctor

$ keyshroud add --env GH_TOKEN --item "GitHub token"

Paste secret for GH_TOKEN: **************************************** keyshroud: created the local vault ~/.config/keyshroud/vault.json; its key is in the macOS keychain (keyshroud-vault-9f2c4e6a1b3d5f70), so programs running as you can open it without asking. created item=GitHub token env=GH_TOKEN targets=~/.omp/agent/auth.json,~/.pi/agent/auth.json verified=yes

Without a terminal (an agent's shell), add opens a hidden-input dialog on your desktop instead, so an agent can start it and you only paste. Already have a .env? keyshroud import moves it.

The local vault

~/.config/keyshroud/vault.json holds every item, encrypted with AES-256-GCM under one random 256-bit key. Item names are encrypted too; the file is 0600. Where the key lives depends on the machine:

Machine	Key	Unlocking
macOS	login keychain, entry `keyshroud-vault-`	none
Linux with a desktop keyring and systemd	Secret Service (`secret-tool`; found with `busctl`)	none
Windows	DPAPI, bound to your Windows account	none
Docker, servers, SSH with a locked keyring, Linux without systemd	derived from a passphrase (scrypt)	`keyshroud unlock`; a session ends after 30 minutes

The key mode is chosen once, when the vault is created. To be asked for a passphrase on any machine, create it with KEYSHROUD_VAULT_KEY=passphrase keyshroud unlock in a terminal (typed twice, at least 12 characters). When a session has ended, a command that needs a secret asks again: a masked prompt in a terminal, a dialog on the desktop, and over SSH it tells you to run keyshroud unlock.

Nothing can recover a lost key or a forgotten passphrase, and the vault belongs to one machine. vault.json is safe to copy as long as its key is not. For backups and several machines, use Vaultwarden or Bitwarden.

Sync across machines: Vaultwarden or Bitwarden

Keep the secrets in Vaultwarden or Bitwarden instead to have them on several machines; run, the hooks, the MCP server and everything else work the same, through the Bitwarden CLI.

Get a vault — pick one:

Self-host Vaultwarden (free, your server): follow examples/vaultwarden — Docker Compose + Caddy with automatic HTTPS, from an empty VPS to keyshroud doctor, plus backups and hardening.
Bitwarden cloud (free account, no server): sign up at bitwarden.com and skip bw config server below (EU accounts: bw config server https://vault.bitwarden.eu).

npm install -g @bitwarden/cli

1. Point bw at your server and log in once

bw config server https://vault.example.com bw login

2. Make it the default for new items (local:// items keep working)

mkdir -p ~/.config/keyshroud && echo bw > ~/.config/keyshroud/backend

3. Unlock for 30 minutes (asks for the master password, which is not stored)

keyshroud unlock

4. Check everything

keyshroud doctor

keyshroud picks the default once per machine and writes it to ~/.config/keyshroud/backend: Vaultwarden when it finds a bw login or anything keyshroud 0.7 left behind, so upgrades change nothing; the local vault otherwise. KEYSHROUD_BACKEND=local|bw overrides it, and keyshroud setup switches to Vaultwarden by itself. References name their vault, so local://… and bw://… items work side by side, and --item local://Name or --item bw://Name picks one for a single item.

keyshroud never stores the master password unless you do. When Vaultwarden is locked and a command needs a secret, it asks: a masked prompt in a terminal, a native dialog on the desktop (so an agent's command waits for you), and over SSH it tells you to run keyshroud unlock. A session ends after 30 minutes (KEYSHROUD_SESSION_TTL_MS): a timer runs bw lock, so a copied session token stops working too. On a host nobody sits at, keyshroud unlock --unattended asks once, in a terminal only, and opens a session without an end.

To unlock without being asked, store the master password in the OS keychain (security add-generic-password -a "$USER" -s vaultwarden-master-password -w, or secret-tool store on Linux; after setup the entry is keyshroud-master-password; see the vault setup guide). Any program running as you can then read it, agents included. Windows has no keychain support for it.

Least privilege: a separate agent account

With the steps above, an unlocked session opens your whole Vaultwarden vault, and an agent that runs bw as you can use it. setup gives keyshroud it

只显示了开头部分；其余内容请在仓库中阅读

keyshroud

概览

PopNx MCP 的三大支柱

它能帮你做什么

安装

安装之前

它能做什么

基础检查i

作者与仓库一致

仍在维护

有许可证

端点有响应

使用 OAuth 登录

工具描述中没有隐藏指令

与“网络安全”中的其他服务器比较i

常见问题

替代选择

Phishnoo Sandbox

Zovo Dependency Audit

TeamOnly

作者的 README

Why keyshroud?

Features

Supported agents

Use cases

Quickstart

1. Store a secret — typed into a masked prompt, never echoed.

The first one creates the local vault.

2. Use it

3. Check everything

The local vault

Sync across machines: Vaultwarden or Bitwarden

1. Point bw at your server and log in once

2. Make it the default for new items (local:// items keep working)

3. Unlock for 30 minutes (asks for the master password, which is not stored)

4. Check everything

Least privilege: a separate agent account