@agentkeys-io/mcp

@agentkeys/mcp

An MCP (Model Context Protocol) server that lets AI agents manage credentials and make proxied API calls through AgentKeys.

Instead of hardcoding API keys in your AI agent configs, store them in AgentKeys and let your agent fetch and use them safely through the proxy — without ever seeing the raw secrets.

Quick Start

AGENTKEYS_API_KEY=ak_ws_xxxx npx @agentkeys/mcp

Get your workspace API key from app.agentkeys.io/settings.

Configuration

Environment Variable	Required	Default	Description
AGENTKEYS_API_KEY	✅ Yes	—	Workspace API key (starts with ak_ws_)
AGENTKEYS_URL	No	https://app.agentkeys.io	AgentKeys web app URL (for local dev: http://localhost:3000)
AGENTKEYS_PROXY_URL	No	https://proxy.agentkeys.io	AgentKeys proxy URL (for local dev: http://localhost:3006)

MCP Client Configuration

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "agentkeys": {
      "command": "npx",
      "args": ["@agentkeys/mcp"],
      "env": {
        "AGENTKEYS_API_KEY": "ak_ws_your_key_here"
      }
    }
  }
}

OpenClaw

Add to your OpenClaw MCP config:

{
  "mcpServers": {
    "agentkeys": {
      "command": "npx",
      "args": ["@agentkeys/mcp"],
      "env": {
        "AGENTKEYS_API_KEY": "ak_ws_your_key_here"
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project (or the global config):

{
  "mcpServers": {
    "agentkeys": {
      "command": "npx",
      "args": ["@agentkeys/mcp"],
      "env": {
        "AGENTKEYS_API_KEY": "ak_ws_your_key_here"
      }
    }
  }
}

Local development

{
  "mcpServers": {
    "agentkeys": {
      "command": "npx",
      "args": ["@agentkeys/mcp"],
      "env": {
        "AGENTKEYS_API_KEY": "ak_ws_your_key_here",
        "AGENTKEYS_URL": "http://localhost:3000",
        "AGENTKEYS_PROXY_URL": "http://localhost:3006"
      }
    }
  }
}

Available Tools

Credential Management

list_credentials

List all credentials stored in the workspace.

Returns: Array of credentials with id, name, type, provider, status, createdAt.

create_credential

Create a new credential in the workspace.

Parameter	Type	Required	Description
name	string	✅	Unique name for this credential
type	string	✅	API_KEY | OAUTH | SESSION | BASIC_AUTH | CUSTOM_HEADER | QUERY_PARAM | COOKIE
value	string	For API_KEY/OAUTH/SESSION	The secret value (API key, token, etc.)
provider	string	No	Provider name (e.g. openai, github, stripe)
baseUrl	string	No	Provider API base URL
scopes	string[]	No	OAuth scopes
basicAuth	object	For BASIC_AUTH	{ username, password }
customHeaders	array	For CUSTOM_HEADER	[{ name, value }]
queryParams	array	For QUERY_PARAM	[{ name, value }]
cookies	array	For COOKIE	[{ name, value }]

delete_credential

Delete a credential by ID. Also revokes all associated proxy tokens.

Parameter	Type	Required	Description
credentialId	string	✅	Credential ID (from list_credentials)

Agent Management

list_agents

List all agents in the workspace, including their assigned credentials.

Returns: Array of agents with id, name, description, agentCredentials.

create_agent

Create a new agent identity in the workspace.

Parameter	Type	Required	Description
name	string	✅	Unique agent name (e.g. data-pipeline, support-bot)
description	string	No	What this agent does

delete_agent

Delete an agent. Revokes all proxy tokens assigned to it.

Parameter	Type	Required	Description
agentId	string	✅	Agent ID (from list_agents)

assign_credential

Assign a credential to an agent. Returns a proxy token the agent uses to make API calls.

⚠️ The proxy token is shown once — store it securely.

Parameter	Type	Required	Description
agentId	string	✅	Agent ID
credentialId	string	✅	Credential ID to assign
permissions	string[]	No	Allowed methods/patterns (e.g. ["GET", "POST /v1/chat*"])
expiresAt	string	No	ISO 8601 expiry datetime

Proxy Requests

proxy_request

Make an API call through the AgentKeys proxy using a proxy token. The proxy injects the real credential automatically — your agent never sees the raw secret.

Parameter	Type	Required	Description
proxyToken	string	✅	Proxy token (starts with pxr_) from assign_credential
url	string	✅	Full target URL (e.g. https://api.openai.com/v1/models)
method	string	No	HTTP method (default: GET)
headers	object	No	Additional request headers
body	string	No	JSON string body (for POST/PUT/PATCH)

Typical Workflow

1. list_credentials          → see what's available
2. list_agents               → see existing agents
3. create_agent              → create agent for this task
4. assign_credential         → get proxy token
5. proxy_request             → call API using proxy token

Or if credentials/agents already exist:

1. list_agents               → find agent ID
2. list_credentials          → find credential ID  
3. assign_credential         → get proxy token
4. proxy_request             → call API

Security Model

• API key → identifies your workspace (never leaves your machine)
• Proxy token → scoped credential for one agent (can expire, can be revoked)
• Raw secrets → never exposed to agents; only the proxy can see them

The AgentKeys proxy intercepts requests, validates the proxy token, injects the real credential, and forwards to the target API.

Development

# Clone the monorepo
git clone https://github.com/agentkeys/agentkeys

# Install & build
cd packages/mcp
npm install
npm run build

# Run locally
AGENTKEYS_API_KEY=ak_ws_xxx AGENTKEYS_URL=http://localhost:3000 npx tsx src/index.ts