KeyVault
Polski Sign in

API key vault for AI agents

Let your agents use API keys without ever seeing them

KeyVault stores your keys encrypted and hands them to Claude Code, Cursor and other MCP clients as a local file. The key is decrypted on your machine, so it never lands in the chat, the transcript or the model's context.

Start freeSign in

Encrypted in your browser. The server only ever stores ciphertext.

# the agent asks for a key› get_secret("openai")Secret 'openai' decrypted on device → ~/.config/keyvault/openai.env (mode 600, defines $KV_OPENAI).# and uses it without printing it$ source ~/.config/keyvault/openai.env && curl -H "Authorization: Bearer $KV_OPENAI" …# done? remove it from disk› forget_secret("openai")Removed ~/.config/keyvault/openai.env.
What your agent actually gets: a path, not the key.

A pasted key outlives the task

Paste a key into a chat so an agent can call an API, and from then on it sits in the conversation history, the session transcript and every log that keeps them. You can't take it back. You can only rotate it.

  • Transcripts and chat history keep keys long after the work is done.
  • One stack trace or debug print is enough to dump a key straight into the model's context.
  • One shared key for every tool means you can't cut off one without breaking the rest.

How it works

  1. Save the key

    Add it in the web app. Your browser encrypts it with a key derived from your master password (Argon2id) before anything is sent.

  2. Choose what agents may read

    Agent access is off by default. Turn it on per secret, and give each agent its own token, limited to specific keys if you like.

  3. Your agent uses it

    The KeyVault MCP server decrypts the key on your device, writes it to a file only you can read (mode 600) and hands the agent the path. The agent loads it with source, and forget_secret deletes the file when it's done.

What the server can and can't see

KeyVault is built so the server has nothing useful to leak. Here is exactly what is stored and where decryption happens.

  • Zero-knowledge vault

    Your master password never leaves the browser. Secrets are encrypted with libsodium (Argon2id + secretbox), and the server stores only ciphertext it cannot decrypt.

  • Agent copies sealed to your device

    Secrets you share with agents are sealed with RSA-OAEP + AES-GCM to a key that exists only on your device. The API serves ciphertext; decryption happens locally.

  • Tokens a database dump won't give away

    Agent tokens are 256-bit random values. Only their SHA-256 hash is stored, so a copy of the database contains no working token.

  • Access log

    Every agent read is logged with the token, the key, the outcome and the IP address. Entries are kept for 30 days.

  • Rate limits

    Each token can make at most 60 requests per minute.

  • Enforced in code

    A guard script in the codebase fails if code that decrypts secrets on the server ever appears in the backend.

You decide which agent reads which key

  • One token per agent

    Give Claude Code, Cursor and your CI separate tokens. The log shows who read what, and revoking one leaves the others working.

  • Scoped tokens

    Limit a token to specific keys. Anything outside its scope looks to it as if it didn't exist.

  • Device pairing

    Approve a new device in the browser by comparing a short fingerprint shown in both places. Each device gets its own key and token, and the pairing link expires after 30 minutes.

  • Clean revocation

    Revoking a device revokes its tokens and deletes every key sealed to it, so there is nothing left for it to ask for or read.

Works with local MCP clients

The KeyVault MCP server runs locally over stdio, so it works with any client that can start a local MCP server, including:

  • Claude Code
  • Claude Desktop
  • Cursor
  • Windsurf
  • Cline
  • Roo Code
  • VS Code (Copilot agent)
  • Zed

Hosted agents that can't run a local process can list your keys but can't decrypt them. Decryption needs a key on a real device, and that's deliberate.

Pricing

Start for free and move to a paid plan when you need more.

  • Free

    $0

    TODO: what the free plan includes and its limits.

    Start free

  • TODO: paid plan name

    TODO: price per month

    TODO: what the paid plan adds.

Questions

Can KeyVault read my keys?

No. Everything is encrypted before it reaches the server: the web vault with a key derived from your master password, agent copies with a key that exists only on your device. The server stores ciphertext and holds neither key.

What if I forget my master password?

Your secrets can't be recovered, not by you and not by us. That's the price of the server never knowing your key. Pick a password you'll remember, or keep it in your password manager.

Does the key end up in my agent's context?

No. get_secret returns a file path and an environment variable name, never the value. The agent uses the key through source, so agents that redact secrets have nothing to redact.

What isn't encrypted?

The name, slug, category and description you give each secret, the access log and your email address. Keep anything sensitive out of names and descriptions.

How do I connect my agent?

Add the KeyVault MCP server to your client's configuration. It's the same block for Claude Code, Cursor, Windsurf and the rest. TODO: link to the installation guide.

Stop pasting keys into chats

Set up your vault, connect your agent, and keep keys out of transcripts from today.

Start freeSign in