# aarifmms/keyblind [Health: Active]

**Category:** 🛠️ Other Tools and Integrations  
**Repository:** https://github.com/aarifmms/keyblind  
**GitHub Stars:** 3  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/aarifmms-keyblind

## Description
Encrypted secrets vault with MCP for AI agents. Secrets resolved at runtime, never leaked to LLM conversations.

## Tools
Capabilities this server exposes over MCP:

- **resolve_secret** — Resolve a secret at runtime (value hidden from transcript)
- **store_secret** — Encrypt and store a secret
- **list_secrets** — List secret names (values never revealed)
- **delete_secret** — Delete a secret
- **sandbox_env** — Replace `.env` values with deterministic fakes
- **unsandbox_env** — Restore real `.env` values from vault
- **audit_log** — View secret resolution audit trail
- **totp_code** — Generate a TOTP 2FA code for a stored config
- **totp_store** — Store a TOTP configuration from otpauth:// URI
- **totp_list** — List all stored TOTP configurations
- **totp_delete** — Delete a TOTP configuration
- **create_share_link** — Create encrypted, expiring share link for a secret
- **receive_share** — Receive and decrypt a shared secret
- **deadman_status** — Check dead man's switch status
- **deadman_checkin** — Reset dead man's switch timer
- **sso_status** — Check SSO/OIDC authentication status

## Claude Desktop Quick Installation
Install path inferred — verify against the README before running it. Uses `npx` (confidence: medium):

```json
"mcpServers": {
  "keyblind": {
    "command": "npx",
    "args": ["-y","keyblind","start"]
  }
}
```

## Documentation

## What aarifmms/keyblind MCP server does

The aarifmms/keyblind MCP server provides an MCP interface to an encrypted secrets vault. It is intended for development workflows where an AI coding agent needs to use credentials without receiving the plaintext value in its conversation transcript. Secrets are stored in an encrypted SQLite vault, with AES-256-GCM encryption and PBKDF2 key derivation.

The default vault is local and stored under `~/.keyblind/`. The project also lists optional backends for 1Password, Bitwarden, environment variables, AWS, GCP, and Azure. External backends may require their corresponding command-line tools, such as `op`, `bw`, `aws`, `gcloud`, or `az`.

## How it works

After initialization, secrets can be stored through the CLI or MCP. An agent can request a named secret through `resolve_secret`; the value is resolved at runtime rather than placed in the model conversation. Secret names can be listed without revealing their values, and access activity can be viewed through the audit functionality.

The server also supports replacing `.env` values with deterministic fake values for agent-facing work, then restoring the real values from the vault. The CLI can run a command with secrets injected as environment variables using `keyblind run`.

Additional MCP operations cover TOTP configuration and code generation, encrypted expiring share links, dead man's switch status and check-ins, and SSO/OIDC status. These capabilities are subject to the license tier described by the project.

## Setup and configuration

Install the npm package globally, initialize a vault, and configure MCP for Claude Code:

```bash
npm i -g keyblind
keyblind init
keyblind setup-mcp
```

The server can also be started directly for a manual MCP configuration:

```bash
keyblind start
```

The README shows a Claude Code configuration using `claude mcp add --scope user keyblind -- keyblind start`. Other editor-specific configurations are documented by the project. An HTTP mode is available with `keyblind start --http` for the web dashboard, while `--biometric` enables a biometric requirement where supported and licensed.

## Tools and capabilities

The aarifmms/keyblind MCP server exposes tools for:

- Resolving, storing, listing, and deleting secrets.
- Sandboxing and restoring `.env` files.
- Viewing the secret-resolution audit trail.
- Storing TOTP configurations from `otpauth://` URIs and generating codes.
- Listing and deleting TOTP configurations.
- Creating encrypted, expiring share links and receiving shared secrets.
- Checking or resetting the dead man's switch.
- Checking SSO/OIDC authentication status.

The CLI additionally supports backend selection, secret rotation and expiry checks, license status, and environment injection for commands.

## Limitations and notes

The free tier supports five secrets. Pro and Team tiers add or unlock capabilities including unlimited secrets, audit logs, secret sharing, dead man's switch, TOTP 2FA, biometric gating, CI/CD integration, and team vaults as listed in the README. SSO/OIDC is listed for Team. The project is MIT licensed, but some features require a Pro or Team license.

The provided material describes local vault operation as having no network, telemetry, accounts, or analytics for that mode. External backends, the dashboard, and licensed collaboration features may have separate requirements. Plaintext handling outside the MCP transcript, such as command execution or copying a value in a dashboard, should be evaluated against the workflow's own security controls.

_Full upstream README: https://allmcps.com/mcp/aarifmms-keyblind/readme_