@clavisagent/mcp-server

@clavisagent/mcp-server

MCP server for Clavis — secure credential management for Claude Desktop.

Credentials are injected server-side. Claude never sees raw API keys.

Installation

npm install -g @clavisagent/mcp-server

Claude Desktop Setup

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "clavis": {
      "command": "npx",
      "args": ["-y", "@clavisagent/mcp-server"],
      "env": {
        "CLAVIS_API_KEY": "eyJ...",
        "CLAVIS_API_URL": "https://your-clavis-instance.com"
      }
    }
  }
}

Config file locations:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Get your API key from POST /v1/auth/login — use the access_token (JWT), not the cla_... key shown at registration.

Tools

list_services

List all services with stored credentials.

check_credential_status

Check credential health without making any external API call.

service_name: "stripe"
→ Valid: yes, Status: healthy, Expires in: 58 minutes

call_service ← Recommended

Make an API call with server-side credential injection. The credential never reaches Claude.

service_name: "stripe"
method: "GET"
url: "https://api.stripe.com/v1/balance"
→ Status: 200, Body: {"object": "balance", ...}

get_credentials ← Legacy

Returns raw credential data. Use call_service instead — it keeps secrets out of the conversation entirely.

Self-Hosted Setup

If running Clavis locally:

{
  "mcpServers": {
    "clavis": {
      "command": "node",
      "args": ["/path/to/clavis-mcp/dist/index.js"],
      "env": {
        "CLAVIS_API_KEY": "eyJ...",
        "CLAVIS_API_URL": "http://localhost:8000"
      }
    }
  }
}

Changelog

v0.1.1

• Added call_service tool (server-side credential injection)
• call_service is the recommended tool for prompt injection immunity

v0.1.0

• Initial release: list_services, check_credential_status, get_credentials

License

MIT