Keyblind

io.github.aarifmmsPublished by GitHub account aarifmmsv0.8.8Updated Oct 24, 2026

Encrypted secrets vault for AI agents. 27 MCP tools resolve secrets at runtime, never leaking them.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local encrypted secrets vault exposed over MCP, letting an AI assistant store, list, resolve and delete secrets without the values entering the chat transcript.

What you can do
  • Store, list, resolve and delete secrets in an encrypted local vault, with values kept out of the transcript
  • Sandbox and unsandbox .env files so agents see deterministic fake values instead of real ones
  • Review the audit trail, generate TOTP codes, and create or receive expiring encrypted share links
  • Manage team vaults, register agents, record signed actions and export compliance reports
  • Check dead man's switch status and SSO/OIDC authentication status
When to use it
Useful when you let coding agents work in projects that need API keys, database URLs or tokens and want them resolved at runtime rather than pasted into conversations or committed to .env files. Also relevant for teams that need audit trails, per-secret policies or approval gates on agent access.
Requirements
Runs locally as an npm package (keyblind) over stdio, typically started with npx or the keyblind start command; a vault must be initialized first. No accounts, API keys or environment variables are declared. Optional backends such as 1Password, Bitwarden, AWS, GCP or Azure need their respective CLIs. Some features (team vaults, audit log, sharing, TOTP, biometric gate, SSO) require a paid Pro or Team license.
Before you install
It holds your most sensitive credentials, so protect the vault and its passphrase; the encryption key is bound to the machine fingerprint. Tools can write, overwrite and delete secrets, sandbox or restore .env files, and create share links, so agent-initiated changes should be reviewed. The local dashboard is served without login or pairing token, and the biometric gate and several other features need a paid license.

Installation

In SourceWeft

  1. Open Keyblind in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Keyblind — Blind AI to Your Keys

Encrypted secrets vault with MCP for AI agents. One command configures every editor. Secrets resolved at runtime, never leaked to LLM conversations.

[npm version] [License: MIT]

Why

Developers regularly leak API keys, passwords, and tokens to AI coding tools. 100,000+ LLM conversations with exposed secrets were found indexed by search engines in 2025.

AI agents read your .env files. They copy-paste secrets into conversations. They commit them accidentally. Keyblind stops this by keeping secrets encrypted at rest and resolving them at runtime — the plaintext value never touches the LLM transcript.

How It Works

┌──────────┐     ┌────────────────┐     ┌─────────────────┐│ AI Agent │ ──→ │  Keyblind MCP  │ ──→ │  Encrypted      ││ (Claude) │     │  Server        │     │  SQLite Vault   ││          │ ←── │  (27 tools)    │ ←── │  (AES-256-GCM)  │└──────────┘     └────────────────┘     └─────────────────┘      ↑                                        │      │ secret value never appears             │ secrets never      │ in conversation transcript             │ stored in plaintext

Quick Start

bash
# 1. Installnpm i -g keyblind
# 2. One-command setup (initialize vault + configure Claude Code)keyblind quickstart
# 3. Store secretsecho "sk-proj-abc123" | keyblind set OPENAI_API_KEYkeyblind set DATABASE_URL -    # prompts securely
# 4. Sandbox your .env (AI agents see fakes)keyblind sandbox
# 5. Resolve a secretkeyblind get OPENAI_API_KEY
# 6. Run commands with secrets injected as env varskeyblind run -- npm start
# 7. List all secrets (names only, values hidden)keyblind list

That's it. After keyblind quickstart, restart Claude Code. Then just say "list my keyblind secrets" or "use my OPENAI_API_KEY" — the AI agent resolves secrets at runtime without ever seeing them in the transcript.

MCP Server

Keyblind is MCP-first — it works with every AI tool that speaks the Model Context Protocol (Claude Code, Cursor, Copilot, Windsurf, Cline, Zed).

Setup (automatic)

bash
keyblind setup-mcp

This auto-configures Claude Code, Cline, and Zed to use Keyblind. Works from any directory.

For project-local editors (Cursor, Windsurf, Copilot, Cline project mode), run from your project root:

bash
keyblind setup-mcp --local

See editor-specific configs for details and manual setup.

Setup (manual)

Add a .mcp.json to your project root, or use claude mcp add:

bash
claude mcp add --scope user keyblind -- keyblind start

With biometric gate (Touch ID required before secrets are resolved):

bash
keyblind unlock                      # Authenticate firstclaude mcp add keyblind -- keyblind start --biometric

Session expires after 15 minutes. Requires Pro or Team license.

MCP Tools

ToolDescription
resolve_secretResolve a secret at runtime (value hidden from transcript)
store_secretEncrypt and store a secret
list_secretsList secret names (values never revealed)
delete_secretDelete a secret
sandbox_envReplace .env values with deterministic fakes
unsandbox_envRestore real .env values from vault
audit_logView secret resolution audit trail
totp_codeGenerate a TOTP 2FA code for a stored config
totp_storeStore a TOTP configuration from otpauth:// URI
totp_listList all stored TOTP configurations
totp_deleteDelete a TOTP configuration
create_share_linkCreate encrypted, expiring share link for a secret
receive_shareReceive and decrypt a shared secret
deadman_statusCheck dead man's switch status
deadman_checkinReset dead man's switch timer
team_initCreate a shared team vault (encrypted SQLite)
team_pushPush a local secret to the team vault
team_pullImport all secrets from the team vault
team_listList secret names in the team vault
team_resolveResolve (decrypt) a secret from the team vault
team_deleteDelete a secret from the team vault
sso_statusCheck SSO/OIDC authentication status
register_agentRegister an AI agent bound to a human sponsor
record_actionAppend a signed action to the tamper-proof ledger
verify_ledgerVerify ledger integrity (hash chain + signatures)
list_agentsList registered AI agents
export_complianceExport the agent ledger as a compliance report

Web Dashboard

Manage your secrets from a browser — no sign-in or pairing required. Open the local dashboard:

bash
keyblind dashboard

This starts the local server and opens http://localhost:4318/ in your browser. The dashboard is served same-origin with the REST API, so it works in every browser with no CORS, no pairing token, and no login. Features:

  • View, add, copy, and delete secrets
  • Audit log with full access history
  • License management (tier, email, expiry)
  • Pro/Team tier status
  • Per-secret access policies and rotation reminders
  • Agent action approvals (approve/deny queued agent writes)
  • Central control plane (org-wide visibility + signed revocation)

A hosted control plane (hosted/) adds orgs, roles, groups, a signed revocation + group-scope manifest, multi-provider SSO login (with org auto-provisioning, multi-org switching, and IdP end-session revocation), and short-lived agent credentials. See docs/enterprise.md (Phase 2).

Browser Extension

The Keyblind Chrome Extension detects and blocks secrets from being pasted into AI chat interfaces (Claude.ai, ChatGPT, Copilot).

[Chrome Web Store]

Features:

  • Detects 12+ API key formats (OpenAI, GitHub, Stripe, AWS, etc.)
  • Intercepts paste events on AI chat sites
  • Warning banner when secrets are detected
  • Popup with vault connection status

Located in browser-extension/. Load as unpacked extension from chrome://extensions.

Pricing

FreeProTeam
Price$0$79/year$29/user/month
Secrets5UnlimitedUnlimited
Local vault✓✓✓
Sandbox / Unsandbox✓✓✓
MCP server✓✓✓
Dashboard✓✓✓
Browser extension✓✓✓
7 backends✓✓✓
Team vaults—✓✓
Audit log—✓✓
Secret sharing—✓✓
Dead man's switch—✓✓
TOTP 2FA—✓✓
Biometric gate—✓✓
SSO/OIDC——✓
CI/CD integration—✓✓
bash
# Buy a license at keyblind.dev, then activate:keyblind activate <your-license-key>
# Check your statuskeyblind status

Backends

Keyblind supports multiple secret backends:

bash
keyblind backends                          # List available backendskeyblind backend 1password                 # Switch to 1Passwordkeyblind backend bitwarden                 # Switch to Bitwarden
BackendReadWriteRequires
local (default)✓✓Nothing
1password✓✓op CLI
bitwarden✓—bw CLI
env✓—Nothing
aws✓✓aws CLI
gcp✓✓gcloud CLI
azure✓✓az CLI

Keyblind vs Cloak

KeyblindCloak
ProtocolMCP (all editors)VS Code extension only
EditorsClaude Code, Cursor, Copilot, Windsurf, Cline, ZedVS Code, Cursor
StorageAES-256-GCM SQLiteAES-256-GCM file
BackendsLocal, 1Password, Bitwarden, Env, AWS, GCP, AzureLocal only
SandboxDeterministic HMAC fakesAES-256-GCM encrypted
Web dashboard✓ (localhost:4318)—
Browser extension✓ (Chrome)—
TOTP 2FA✓—
Secret sharing✓ (encrypted URL fragment)—
Dead man's switch✓—
Touch ID✓ (macOS biometric gate)✓
CI/CDkeyblind run for env injection—
NetworkZero (fully local)Zero
LicenseMITProprietary
Free tier✓ (5 secrets)✓
Pro$79/year (unlimited)—

Security

  • AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
  • Machine-identity-bound key — encryption key XOR-wrapped with machine fingerprint
  • Zero network, zero telemetry — no cloud, no accounts, no analytics
  • Vault stored at ~/.keyblind/ with 0700 permissions
  • Deterministic sandbox fakes using HMAC-SHA256 per project + key name

Verifying Your Install

Releases are built and published from GitHub Actions with npm provenance, which attests the tarball was produced from this repository's CI rather than a developer machine.

bash
npm audit signatures        # Verify npm registry signatures

To verify build provenance for a release, open the release page at https://github.com/aarifmms/keyblind/releases and check the "Provenance" and "Attestations" sections, which link the tarball to the exact commit and workflow run that built it.

  • Small dependency graph — the CLI depends on three packages only (MCP SDK, better-sqlite3, zod). Server-only deps (Stripe, Resend, the Vercel CLI) live in the hosted/ and dashboard/ packages and are not installed by npm i -g keyblind.
  • No source maps — the published tarball ships compiled JavaScript with no embedded original source.

CLI Reference

keyblind quickstart           One-command setup (init + configure Claude Code)keyblind init                 Initialize the encrypted vaultkeyblind set <name>           Store a secret (value from stdin)keyblind set <name> -         Store a secret (prompts securely)keyblind get <name>           Resolve and print a secretkeyblind list                 List all stored secretskeyblind delete <name>        Delete a secretkeyblind setup-mcp            Auto-configure MCP for Claude Code, Cline, Zedkeyblind setup-mcp --local    Write project MCP configs (Cursor, Windsurf, Copilot, Cline)keyblind sandbox [.env]       Replace .env with deterministic fakeskeyblind unsandbox [.env]     Restore real .env valueskeyblind run <command...>     Run command with secrets as env varskeyblind start                Start MCP server (stdio — for AI agents)keyblind start --http         Start HTTP server (dashboard + MCP + REST API)keyblind dashboard            Open the web dashboard in your browserkeyblind start --biometric    Start MCP server with biometric requirementkeyblind backends             List available backendskeyblind backend <name>       Switch backendkeyblind activate <key>       Activate a Pro/Team licensekeyblind deactivate           Remove current licensekeyblind status               Show license and vault statuskeyblind audit                Show secret resolution audit logkeyblind check --expired      List secrets past expirykeyblind rotate <name>        Update a secret valuekeyblind rotate <name> --generate  Rotate with an auto-generated valuekeyblind rotate <name> --exec "<cmd>"  Rotate via an external command's stdoutkeyblind rotate --overdue [days]    Rotate all secrets past the thresholdkeyblind rotate-needed [days] List secrets not rotated in N days (default 90)keyblind agents list         List registered AI agentskeyblind agents register <name> <sponsor> [scope]  Register an agent (prints signing key)keyblind agents verify       Verify agent ledger integritykeyblind agents export [json|csv]  Export compliance reportkeyblind agents enforce on|off  Require signed agent identity for secret accesskeyblind policy set <secret> <policy>  Restrict which agents may access a secretkeyblind policy list          List per-secret policieskeyblind approvals list       List pending approval requestskeyblind approvals approve <id>  Approve and execute a pending requestkeyblind approvals deny <id>  Deny a pending requestkeyblind approvals require on|off  Require approval for all agent writeskeyblind approvals require <secret>  Require approval for a specific secretkeyblind approvals unrequire <secret>  Stop requiring approval for a secretkeyblind control-plane init   Generate the org signing keypairkeyblind control-plane export  Export a signed, value-free control-plane bundlekeyblind control-plane trust <pubkey>  Trust an org public key (honor its deny list)keyblind control-plane untrust <pubkey>  Remove a trusted org public keykeyblind control-plane trusted  List trusted org public keyskeyblind control-plane apply <file>  Import a signed deny list (revoked agents)keyblind control-plane revoke <agentId> [reason]  Revoke an agent locallykeyblind control-plane unrevoke <agentId>  Un-revoke an agent locallykeyblind control-plane connect <url>  Connect to a hosted control plane (org API base)keyblind control-plane sync   Pull + apply the signed manifest (deny list + group grants)keyblind control-plane disconnect  Forget the hosted control-plane connectionkeyblind control-plane status  Show the current connection (if any)keyblind scan-repo [--all]    Scan tracked files (or full history) for secretskeyblind setup-ci             Write a GitHub Actions secret-scan workflowkeyblind ci export            Export an encrypted bundle for CI injection (Pro)keyblind ci inject            Decrypt a bundle and write secrets to $GITHUB_ENVkeyblind ci setup             Write a GitHub Actions workflow for CI injectionkeyblind team init [path]     Create a shared team vaultkeyblind team push <name>     Push a secret to team vaultkeyblind team pull            Pull secrets from team vaultkeyblind team list            List secrets in team vaultkeyblind totp set <name>      Store TOTP 2FA configkeyblind totp code <name>     Generate current TOTP codekeyblind totp list            List all TOTP configskeyblind totp delete <name>   Delete a TOTP configkeyblind share <name>         Create encrypted share linkkeyblind receive <url>        Receive a shared secretkeyblind deadman setup        Configure dead man's switchkeyblind deadman checkin      Reset dead man's switch timerkeyblind deadman status       Show dead man's switch statuskeyblind deadman disable      Disable dead man's switchkeyblind sso configure        Set up SSO/OIDC for team accesskeyblind sso login            Authenticate via browser SSOkeyblind sso logout           Clear SSO sessionkeyblind sso status           Show SSO auth statuskeyblind doctor               Run vault health checkkeyblind generate <name>      Generate a strong random secretkeyblind import [.env]        Bulk import from .env filekeyblind export               Export all secretskeyblind completions [shell]  Generate shell completion script

Development

bash
git clone https://github.com/aarifmms/keyblind.gitcd keyblindnpm installnpm run build       # Compile TypeScriptnpm test            # Run testsnpm run dev         # Watch mode

License

MIT

Source: README.md at commit 6622cbb

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the server did not start.

Version history

2
  1. v0.8.8LatestOct 21, 2026
  2. v0.1.4Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts