Ethereum Keystore Encryption

io.github.nirholasPublished by GitHub account nirholasv1.0.0Updated Oct 24, 2026

Encrypt/decrypt Ethereum keystore JSON V3 with scrypt/PBKDF2 for secure cold storage

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local MCP server for encrypting, decrypting and managing Ethereum keystore JSON V3 files with scrypt or PBKDF2.

What you can do
  • Encrypt a private key into Web3 Secret Storage V3 format, or decrypt a keystore to recover the private key
  • Save and load keystore files using standard Ethereum naming, and export a decrypted private key to a file
  • Inspect keystore metadata without decrypting, and validate keystore structure
  • Change a keystore password, optionally upgrading the key derivation function, and batch-encrypt multiple wallets
  • Read bundled resources on the V3 specification, security practices, KDF comparison and examples, and follow guided prompts for backup, migration, recovery and security audit
When to use it
Useful when you want an assistant to create or inspect Ethereum keystore V3 backups, rotate keystore passwords, or migrate legacy wallet formats, especially for offline or cold-storage workflows.
Requirements
Runs as a local process on the user's machine, installed from PyPI as keystore-mcp-server and started with uvx or the keystore-mcp-server command; a Python environment is needed. No accounts, API keys or environment variables are declared. Desktop client only.
Before you install
The server handles raw private keys and keystore passwords, and one tool exports a decrypted private key to a file, which the README itself marks as dangerous. Anything typed into the assistant, including private keys and passwords, passes through the model conversation. Prefer offline use for high-value wallets, keep backups, and be aware that files are written to disk with 0600 permissions.

Installation

In SourceWeft

  1. Open Ethereum Keystore Encryption in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Keystore MCP Server

[PyPI] [MCP Registry]

A Model Context Protocol (MCP) server for Ethereum keystore encryption, decryption, and management following the Web3 Secret Storage Definition Version 3 standard.

Features

Tools (9)

  • encrypt_keystore - Encrypt private key to Web3 Secret Storage V3 format
  • decrypt_keystore - Decrypt keystore to recover private key
  • save_keystore_file - Save keystore with standard Ethereum naming
  • load_keystore_file - Load and validate keystore files
  • get_keystore_info - Extract metadata without decryption
  • validate_keystore - Validate keystore structure
  • change_keystore_password - Change password and optionally upgrade KDF
  • batch_encrypt_keystores - Encrypt multiple wallets
  • keystore_to_private_key_file - Export decrypted private key (dangerous)

Resources (4)

  • keystore://specification - Web3 Secret Storage V3 specification
  • keystore://security-guide - Security best practices
  • keystore://kdf-comparison - Scrypt vs PBKDF2 comparison
  • keystore://examples/{type} - Example keystores

Prompts (4)

  • secure_wallet_backup - Guided backup creation
  • keystore_migration - Migration from legacy formats
  • keystore_recovery - Recovery assistance
  • keystore_security_audit - Security audit workflow

Installation

bash
pip install -e .
# Or with dev dependenciespip install -e ".[dev]"

Usage

Running the Server

bash
keystore-mcp-server

Claude Desktop Configuration

json
{  "mcpServers": {    "keystore": {      "command": "keystore-mcp-server"    }  }}

Cryptographic Standards

Web3 Secret Storage V3

  • KDF: scrypt (recommended) or pbkdf2
  • Cipher: AES-128-CTR
  • MAC: Keccak-256
  • UUID: Version 4

Default Scrypt Parameters

ParameterValueDescription
N262144 (2^18)CPU/memory cost
r8Block size
p1Parallelization
dklen32Derived key length

Default PBKDF2 Parameters

ParameterValueDescription
c262144Iterations
prfhmac-sha256PRF
dklen32Derived key length

Security

⚠️ Important Security Notes:

  1. Never share keystore passwords - Treat like private keys
  2. Use strong passwords - Minimum 12 characters, mixed case, numbers, symbols
  3. Secure file storage - Files created with 0600 permissions
  4. Air-gapped operations - Use offline for high-value wallets
  5. Backup keystores - Store encrypted backups in multiple locations

Examples

Encrypt a Private Key

python
result = await encrypt_keystore(    private_key="0x...",    password="strong-password-123",    kdf="scrypt")

Decrypt a Keystore

python
result = await decrypt_keystore(    keystore=keystore_json,    password="strong-password-123")

Save Keystore File

python
result = await save_keystore_file(    keystore=keystore_json,    directory="./keystores")# Creates: UTC--2024-01-15T10-30-00.000Z--address.json

Testing

bash
pytest tests/ -v

License

MIT License

Source: keystore-mcp-server/README.md at commit dabb599

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.