agent-secrets

Encrypted secrets management MCP server for AI agents. Store, retrieve, rotate, and audit API keys, tokens, and credentials — all encrypted at rest.

Why

AI agents need access to API keys, tokens, and credentials. Hardcoding them or passing via env vars is insecure and unmanageable at scale. agent-secrets provides a single encrypted vault with audit trails, access policies, and rotation — exposed as MCP tools any agent can call.

Features

• AES-128 encryption at rest (Fernet: AES-128-CBC + HMAC-SHA256)
• 14 MCP tools: store, get, list, update, rotate, revoke, delete, search, audit, policies, batch, stats
• Access policies: allow/deny patterns, type restrictions
• Full audit log: every access tracked
• Secret rotation: rotate with history
• CLI + MCP server: use from terminal or any MCP-compatible agent

Quick start

pip install agent-secrets

# CLI
agent-secrets store OPENAI_API_KEY sk-... --type api_key --tag prod
agent-secrets get OPENAI_API_KEY --show
agent-secrets list
agent-secrets rotate OPENAI_API_KEY
agent-secrets audit

# MCP server
agent-secrets serve --db ~/.agent-secrets/vault.db

MCP tools

Tool	Description
store_secret	Store a new encrypted secret
get_secret	Retrieve a secret value
list_secrets	List all secrets (metadata only)
update_secret	Update value/metadata
rotate_secret	Rotate to new value
revoke_secret	Revoke a secret
delete_secret	Permanently delete
search_secrets	Search by name/description/tag
get_audit_log	View access history
create_policy	Create access policy
list_policies	List policies
check_access	Check policy permission
batch_store	Store multiple secrets
vault_stats	Vault statistics

License

MIT