@seekrit/mcp

@seekrit/mcp

The seekrit MCP server, as a standalone npx-able package — so an AI agent (Claude Code, or any MCP client) can provision, manage, and inject end-to-end encrypted secrets with zero prior install.

seekrit is zero-knowledge: secret values, data keys, and private keys never reach the server. Decryption only ever happens where the credential lives, so this MCP server runs on your machine, next to the credential — everything that produces plaintext (a secret value, a data key, a decryption-capable grant) stays on the client. It is the crypto plane of seekrit's two-server design.

This package is a thin entrypoint around the exact same server as the seekrit mcp subcommand of @seekrit/cli; it just publishes it as its own binary so no CLI install is required first.

Setup

Add it to any MCP client with a stdio server whose command runs this package via npx, passing a credential in its environment. For Claude Code:

# An admin token lets the agent provision structure (apps/envs/tokens) too:
claude mcp add seekrit --env SEEKRIT_TOKEN=skt_… -- npx -y @seekrit/mcp

Or drop a .mcp.json in your project — the whole setup is this snippet:

{
  "mcpServers": {
    "seekrit": {
      "command": "npx",
      "args": ["-y", "@seekrit/mcp"],
      "env": {
        "SEEKRIT_TOKEN": "skt_…"
      }
    }
  }
}

Requires Node ≥ 20. Set SEEKRIT_API_URL too if you're not on the hosted API.

As a container

For a sandbox with no Node toolchain, the same server ships as a multi-arch Docker image, seekritdev/mcp. Register a stdio server that runs docker run -i — the -i is required, since stdin is the MCP transport:

{
  "mcpServers": {
    "seekrit": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "SEEKRIT_TOKEN",
        "-v", "${PWD}:/work",
        "seekritdev/mcp"
      ]
    }
  }
}

The bare -e SEEKRIT_TOKEN forwards the token from the client's environment. Mount a workdir at /work for the run_command tool to operate on (it runs inside the container). Pin a release (seekritdev/mcp:0.2.0) or track :edge. The container still decrypts locally — nothing plaintext leaves it.

Choosing the credential

The server authenticates exactly like the CLI — SEEKRIT_TOKEN, or saved config at ~/.config/seekrit/config.json.

Credential	Good for	Notes
Admin token (seekrit token create --admin)	Provisioning: create apps/groups/envs, compose, grant, mint tokens	Org-scoped; the only headless way to create structure.
Runtime token (bound to an env)	Reading/writing/injecting one environment's secrets	Self-decrypts — no passphrase. Cannot provision.

Under user auth (no token), tools that decrypt need SEEKRIT_PASSPHRASE in the server's environment — there is no TTY to prompt on.

Using secrets without exposing them

Prefer the run_command tool: it injects the resolved secrets into a child process and returns only its output, so plaintext never enters the agent's context. get_secret returns metadata by default and only decrypts when you pass reveal: true.

See the AI agents guide for the full tool list and a typical session.