brokre — AI-safe Credential Broker

English | 简体中文

brokre is a local credential broker for AI agents and humans. Use it with Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Hermes Agent, ChatClaw, and other MCP-capable clients to run ssh, mysql, psql, and more — passwords never enter AI context, environment variables, or ps output. It wraps any CLI on your PATH — not only SSH or MySQL — and injects saved passwords at the prompt without exposing plaintext to the AI process, shell history, or process environment.

Developed by Techinone (成都同创合一科技有限公司).

What's New in 0.2.17

0.2.17 is the current release: SessionRelay routed SSH by default, multi-hop bastion routes, local-only list by default, and the existing one-command npm install / auto MCP registration / auto binary upgrade flow.

npm — install, auto-update, auto MCP setup

npm install -g brokre          # or: npx -y brokre@latest

Recommended MCP config (also applied by auto-setup):

{ "command": "npx", "args": ["-y", "brokre@latest"] }

Bastion broker — cluster management

The bastion layer lets AI agents operate many hosts behind one jump box without copying vault passwords into context or scattering secrets on the laptop.

Typical flow for a K8s / DB / batch cluster behind one entry host:

brokre bastion enable b150
brokre bastion sync b150 --json          # pull inner alias catalog
brokre bastion unlock
brokre list --include-bastions --json    # b150::db, b150::worker-01, …
brokre ssh b150::db systemctl status   # MCP: brokre_exec with routed alias

MCP equivalent:

{ "binary": "ssh", "args": ["b150::db", "uname", "-a"] }

Gate policy (default vs strict) — see Bastion gate policy below. Gate is inactive until brokre bastion set-key; then default unlocks only bastion outbound paths; strict requires unlock for every exec while list remains local-only unless bastion discovery is requested.

See Cross-network list inheritance and Bastion proxy below for setup details.

CLI security (core)

brokre is built around one rule: secrets stay out of the AI's reach and out of observable process state.

Full threat model: SECURITY.md, THREAT_MODEL.md.

Any CLI on PATH (generic by design)

brokre is not a fixed list of database/SSH wrappers. The core model is:

brokre <any-cli-on-PATH> [args...]

First connection: run verbatim, capture the password you type at the prompt, offer to save as an alias.
Next time: brokre <cli> <alias> … auto-injects — AI and scripts only see the alias name.

Preset prompt patterns ship for common tools (ssh, mysql, psql, redis-cli, ftp, clickhouse, git, docker, kubectl, sudo, …). Everything else uses a generic password: / passphrase: matcher — no code changes required.

brokre gsql prod-cluster -c "SELECT 1"    # any proprietary CLI on PATH
brokre kubectl get pods                   # if your cluster CLI prompts for a password
brokre my-internal-tool --host db.internal

Customize when needed:

• ~/.brokre/prompts.toml — per-binary prompt regex overrides
• ~/.brokre/manage.toml — custom sections in the manage UI (e.g. GaussDB, internal tools)

Built-in manage UI tabs (when the binary is installed) include SSH, FTP, MySQL, PostgreSQL, Redis, ClickHouse, MinIO — convenience only; the PTY wrapper works for any CLI.

Install (MCP first — recommended for AI)

The npm package brokre launches the local brokre mcp server over stdio for Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Windsurf, VS Code, and other MCP clients.

Choose your install path

Recommended MCP entry (also what auto-setup writes):

{ "command": "npx", "args": ["-y", "brokre@latest"] }

No Node — point MCP at the native binary: { "command": "brokre", "args": ["mcp"] }.

Path A — npm one-liner (0.2.8+)

npm install -g brokre
# or without global install:
npx -y brokre@latest

Windows: npm install -g brokre, open a new terminal, run brokre --version (first run downloads the native CLI if needed). Local npm i brokre (no -g) is not on PATH.

On npm install, three things happen automatically:

1. MCP launcher — brokre-mcp / npx -y brokre@latest spawns brokre mcp.
2. IDE auto-registration — postinstall runs brokre-setup-mcp: detects installed IDEs only (app, CLI, or real usage artifacts — not empty folders) and merges the MCP entry above into each global config. Idempotent; preserves your other MCP servers.
3. Binary auto-upgrade — on each MCP start, if PATH or ~/.brokre/bin/brokre is older than the npm package, the matching GitHub Release is downloaded.

IDEs covered by auto-setup