@hlos/staamp-mcp

@hlos/staamp-mcp

AI agents get capabilities, not credentials.

STAAMP MCP Server enables AI assistants (Claude, Cursor, etc.) to manage secrets and authenticate to services without ever receiving your credentials.

Why HLOS?

Traditional Approach	HLOS STAAMP
Agent receives API keys/tokens	Agent NEVER receives credentials
Leaked prompts = leaked secrets	Nothing to leak
Trust the agent with credentials	Trust only HLOS

The most secure credential is one the AI never touches.

Security Model

Risk	How STAAMP Protects
Prompt injection leaks secrets	Agent never has secrets to leak
Runaway agent spending	Budget envelopes with hard limits
Malicious action execution	Financial gating — no balance = no action
Screen capture exposure	Screen-invisible injection
Memory forensics	Token expiry + disposal (see note below)

Security Guarantee

HLOS backs its security with up to $50,000 coverage for credential breaches on paid plans. Learn more

What is STAAMP?

Secure Trust Agent Access Management Protocol — a credential isolation protocol where:

• Agents NEVER receive credentials — Unlike OAuth, your passwords and tokens are never exposed to the AI
• Screen-invisible injection — Credentials injected directly into browsers, invisible to screen capture
• Financial gating — Every action checks wallet balance and budget limits
• Token lifecycle — Access tokens have automatic expiry and are cleared on disposal

Memory Handling Note

JavaScript cannot guarantee true memory zeroing. The MCP client:

• Token Expiry: Access tokens automatically expire and are cleared after use
• Dispose Method: Calling dispose() dereferences sensitive data to aid garbage collection
• Limitation: Memory may persist until GC runs and could theoretically be extracted via memory dump

For highest-security deployments requiring guaranteed memory clearing, consider native Node.js addons with secure memory primitives or HSMs for key material.

Quick Start

Prerequisites

• Node.js >= 18.0.0
• An HLOS account (hlos.ai)

Installation

npx @hlos/staamp-mcp

Get Your Access Token

• Go to hlos.ai/settings/api
• Generate a new Access Token
• Add to your IDE config below

Claude Desktop

Add to claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "hlos": {
      "command": "npx",
      "args": ["-y", "@hlos/staamp-mcp"],
      "env": {
        "HLOS_ACCESS_TOKEN": "your_access_token_here"
      }
    }
  }
}

Cursor

Add to your Cursor MCP settings:

{
  "hlos": {
    "command": "npx",
    "args": ["-y", "@hlos/staamp-mcp"],
    "env": {
      "HLOS_ACCESS_TOKEN": "your_access_token_here"
    }
  }
}

Available Tools

Secrets Management

Tool	Description
list_secrets	List secrets with metadata
check_secret_exists	Verify secret existence
get_secret_info	Get secret details (never the value)
suggest_missing_secrets	Analyze code for missing secrets
create_secret	Request secret creation (requires approval)
sync_to_platform	Sync to Vercel, GitHub, Supabase
check_health	Secret health dashboard

Agent Authentication (STAAMP)

Tool	Description
request_session	Request authenticated session injection
list_sessions	List captured sessions (no credentials exposed)
check_session_status	Check if session is valid
get_totp_code	Generate 2FA codes without exposing secret

Infrastructure & Spending

Tool	Description
request_capability	Provision SMS, databases, APIs via spending gate
check_wallet	Check wallet balance and limits
list_capabilities	List available infrastructure
list_envelopes	View budget envelopes for agents

How STAAMP Differs from OAuth

Traditional OAuth/Tokens        STAAMP/HLOS
──────────────────────         ─────────────────────────
Agent receives token      →    Agent NEVER gets credentials
Agent stores/uses token   →    HLOS injects directly to service
Token in context window   →    Nothing in context to leak
Token can be extracted    →    Nothing to extract
No spending controls      →    Budget envelopes + financial gating

Trust & Verification

Open Source: This MCP server is open source. Audit the code.

Who We Are: HLOS is built by the team behind SevenRooms ($1.2B exit) and Gilt Groupe ($250M exit). About us

Patents: 3 patents filed, 37 claims protecting the STAAMP architecture.

Security Guarantee: Up to $50K coverage for breaches. Details

Getting Started Path

We recommend a gradual trust ladder:

• Development — Start with dev/test secrets
• Staging — Graduate to internal tools
• Production — Full trust when you're ready

No pressure. Security is about comfort, not speed.

Links

• Website: hlos.ai
• Documentation: hlos.ai/docs
• Security: hlos.ai/security-guarantee
• GitHub: github.com/hlos-ai
• Support: [e-mail]

License

MIT — See LICENSE

Built with STAAMP by HLOS — The credential layer for AI agents.