Sealkeep

What sealkeep MCP server does

sealkeep MCP server allows an AI agent to use credentials while keeping the values outside the agent’s context. Secrets are stored under structured names such as shared/stripe/test/SECRET_KEY; the final path component identifies the environment variable that a command expects.

The server exposes three MCP tools: list_secrets, run_with_secrets, and store_status. Listing reveals available names rather than values. Running a command supplies the requested value through its environment, then replaces that value in stdout and stderr with a marker such as [sealkeep:NAME]. Store status reports the configured storage state without returning credentials.

This fits the 🔒 Security category for workflows where an agent must call authenticated APIs, run development commands, or operate a client that needs a secret but should not read the secret itself.

How it works

sealkeep looks up a requested name in the configured stores, using the first store that contains it. Supported storage backends described by the project are the macOS Keychain, Secret Service, Windows Credential Manager, and Vault KV v2 as a replica.

The command-oriented workflow is handled by the sealkeep run CLI command. A single name sets the variable named by its key, while --all loads the secrets in a folder and -e VAR=NAME maps a stored name to a different environment variable. Store-qualified names can restrict lookup to one store.

For programs that require a file, --dotenv creates a temporary dotenv file readable only by the local user, places its path where the command contains {dotenv}, and removes it after the command exits. Output redaction applies to command stdout and stderr. The guard hook blocks calls that would directly print a value, including reading .env files or using sealkeep get.

Setup and configuration

The MCP-only setup uses the npm package through npx:

{
  "mcpServers": {
    "sealkeep": {
      "command": "npx",
      "args": ["-y", "@munhq/sealkeep"]
    }
  }
}

The package can be configured in any MCP client. Cursor and VS Code provide installation links in the project documentation. Claude Code can install a plugin that adds the MCP server, skill, and guard hook. The project’s installer also supports Claude Code, Codex, and Cursor, with options to install only selected components, preview changes, or omit skills, MCP configuration, or hooks. It backs up JSON files before editing them, and sealkeep doctor checks stores and detected clients.

Secrets can be added with sealkeep set, imported from dotenv or INI-style files with sealkeep import, and inspected for likely credential locations with sealkeep scan. The scan reports paths, key names, classifications, and duplicate-value groups, not secret contents.

Tools and capabilities

• List secret names without exposing their values.
• Run commands with one secret, a folder of secrets, or recursively loaded secrets.
• Map a stored secret to a different environment variable name.
• Redact injected values from standard output and standard error.
• Create temporary dotenv files for compatible commands.
• Check storage and client installation state.
• Use aliases so multiple project names can refer to one stored value.

Limitations and notes

The MCP tools do not return secret values, so an agent cannot use them to retrieve a credential for display. Direct value retrieval with sealkeep get is restricted to an interactive terminal, and the guard hook rejects equivalent agent tool calls.

sealkeep MCP server protects values passed through the supported command workflow; programs still receive the secret in their environment or temporary dotenv file while they run. When using recursive loading, duplicate keys are an error. Temporary dotenv support depends on the invoked program accepting the supplied file path, such as a command option that consumes {dotenv}.

The installer is documented for Linux and macOS binary installation, with a Rust installation option. The MCP package itself is installed with npx, and the project is licensed under MIT.