Encrypted secrets vault with MCP for AI agents. Secrets resolved at runtime, never leaked to LLM conversations.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
One-click editor setup isn’t available for this listing yet — we don’t have a confirmed install command, and we’d rather show nothing than point your editor at the wrong package or host. Follow the project’s own setup instructions, linked above.
Manual Client & Custom JSON ConfigExpand JSON ▾
No confirmed setup config for this listing yet. We only publish a config block when the install details come from the project itself — its README, its docs, or a verified owner. We haven’t found those for aarifmms/keyblind, and we’d rather show nothing than a guess you’d paste into your client. Follow the project’s own setup instructions for the current steps.
Documentation Overview
Keyblind — Blind AI to Your Keys
Encrypted secrets vault with MCP for AI agents. Secrets resolved at runtime, never leaked to LLM conversations.
Why
Developers regularly leak API keys, passwords, and tokens to AI coding tools. 100,000+ LLM conversations with exposed secrets were found indexed by search engines in 2025.
AI agents read your .env files. They copy-paste secrets into conversations. They commit them accidentally. Keyblind stops this by keeping secrets encrypted at rest and resolving them at runtime — the plaintext value never touches the LLM transcript.
How It Works
Quick Start
That's it. After
keyblind setup-mcp, restart Claude Code. Then just say "list my keyblind secrets" or "use my OPENAI_API_KEY" — the AI agent resolves secrets at runtime without ever seeing them in the transcript.
MCP Server
Keyblind is MCP-first — it works with every AI tool that speaks the Model Context Protocol (Claude Code, Cursor, Copilot, Windsurf, Cline, Zed).
Setup (automatic)
This auto-configures Claude Code to use Keyblind. Works from any directory. For other editors, see editor-specific configs.
Setup (manual)
Add a .mcp.json to your project root, or use claude mcp add:
With biometric gate (Touch ID required before secrets are resolved):
Session expires after 15 minutes. Requires Pro or Team license.
MCP Tools
| Tool | Description |
|---|---|
resolve_secret | Resolve a secret at runtime (value hidden from transcript) |
store_secret | Encrypt and store a secret |
list_secrets | List secret names (values never revealed) |
delete_secret | Delete a secret |
sandbox_env | Replace .env values with deterministic fakes |
unsandbox_env | Restore real .env values from vault |
audit_log | View secret resolution audit trail |
totp_code | Generate a TOTP 2FA code for a stored config |
totp_store | Store a TOTP configuration from otpauth:// URI |
totp_list | List all stored TOTP configurations |
totp_delete | Delete a TOTP configuration |
create_share_link | Create encrypted, expiring share link for a secret |
receive_share | Receive and decrypt a shared secret |
deadman_status | Check dead man's switch status |
deadman_checkin | Reset dead man's switch timer |
sso_status | Check SSO/OIDC authentication status |
Web Dashboard
Manage your secrets from a browser at app.keyblind.dev. Start the HTTP server:
Then sign in with your license key at app.keyblind.dev/login. Features:
- View, add, copy, and delete secrets
- Audit log with full access history
- License management
- Pro/Team tier status
Browser Extension
The Keyblind Chrome Extension detects and blocks secrets from being pasted into AI chat interfaces (Claude.ai, ChatGPT, Copilot).
Features:
- Detects 12+ API key formats (OpenAI, GitHub, Stripe, AWS, etc.)
- Intercepts paste events on AI chat sites
- Warning banner when secrets are detected
- Popup with vault connection status
Located in browser-extension/. Load as unpacked extension from chrome://extensions.
Pricing
| Free | Pro | Team | |
|---|---|---|---|
| Price | $0 | $79/year | $29/user/month |
| Secrets | 5 | Unlimited | Unlimited |
| Local vault | ✓ | ✓ | ✓ |
| Sandbox / Unsandbox | ✓ | ✓ | ✓ |
| MCP server | ✓ | ✓ | ✓ |
| Dashboard | ✓ | ✓ | ✓ |
| Browser extension | ✓ | ✓ | ✓ |
| 7 backends | ✓ | ✓ | ✓ |
| Team vaults | — | ✓ | ✓ |
| Audit log | — | ✓ | ✓ |
| Secret sharing | — | ✓ | ✓ |
| Dead man's switch | — | ✓ | ✓ |
| TOTP 2FA | — | ✓ | ✓ |
| Biometric gate | — | ✓ | ✓ |
| SSO/OIDC | — | — | ✓ |
| CI/CD integration | — | ✓ | ✓ |
Backends
Keyblind supports multiple secret backends:
| Backend | Read | Write | Requires |
|---|---|---|---|
| local (default) | ✓ | ✓ | Nothing |
| 1password | ✓ | ✓ | op CLI |
| bitwarden | ✓ | — | bw CLI |
| env | ✓ | — | Nothing |
| aws | ✓ | ✓ | aws CLI |
| gcp | ✓ | ✓ | gcloud CLI |
| azure | ✓ | ✓ | az CLI |
Keyblind vs Cloak
| Keyblind | Cloak | |
|---|---|---|
| Protocol | MCP (all editors) | VS Code extension only |
| Editors | Claude Code, Cursor, Copilot, Windsurf, Cline, Zed | VS Code, Cursor |
| Storage | AES-256-GCM SQLite | AES-256-GCM file |
| Backends | Local, 1Password, Bitwarden, Env, AWS, GCP, Azure | Local only |
| Sandbox | Deterministic HMAC fakes | AES-256-GCM encrypted |
| Web dashboard | ✓ (app.keyblind.dev) | — |
| Browser extension | ✓ (Chrome) | — |
| TOTP 2FA | ✓ | — |
| Secret sharing | ✓ (encrypted URL fragment) | — |
| Dead man's switch | ✓ | — |
| Touch ID | ✓ (macOS biometric gate) | ✓ |
| CI/CD | keyblind run for env injection | — |
| Network | Zero (fully local) | Zero |
| License | MIT | Proprietary |
| Free tier | ✓ (5 secrets) | ✓ |
| Pro | $79/year (unlimited) | — |
Security
- AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
- Machine-identity-bound key — encryption key XOR-wrapped with machine fingerprint
- Zero network, zero telemetry — no cloud, no accounts, no analytics
- Vault stored at
~/.keyblind/with0700permissions - Deterministic sandbox fakes using HMAC-SHA256 per project + key name
CLI Reference
Development
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Keyblind
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/aarifmms-keyblind)HTML Embed
<a href="https://allmcps.com/mcp/aarifmms-keyblind"><img src="https://allmcps.com/api/badge/aarifmms-keyblind?style=directory" alt="Keyblind on AllMCPs" /></a>