Connect Claude Code, Cursor, Windsurf and other MCP-compatible AI agents to ProphetKey's local proxy. The agent calls prophetkey_* tools over stdio; the bridge forwards them to ProphetKey's local HTTP proxy (127.0.0.1:1421/mcp). Real API keys never leave your device and are never exposed to the agent.

AI agent (stdio)  ──►  prophetkey-mcp   ──►  ProphetKey proxy
 Claude Code /                                      │
 Cursor / Windsurf        Bearer token               │ injects real key
 (never sees key)                                    ▼
                                      real API call has no key handling

Requirements

ProphetKey desktop app (v1.2.0+) running on the same machine
- Download: https://github.com/LBZ558/prophetkey-releases/releases
- Enable the local MCP proxy in Settings → MCP Server
Node.js >= 18

Quick start

1. Get your token

Open ProphetKey → Settings → MCP Server and copy the bearer token from the generated config.

2. Configure your AI agent

Claude Code (~/.claude/settings.json):

{
  "mcpServers": {
    "prophetkey": {
      "command": "npx",
      "args": ["-y", "prophetkey-mcp"],
      "env": { "PROPHETKEY_MCP_TOKEN": "your-token-here" }
    }
  }
}

Cursor (Project → MCP → Add):

npx -y prophetkey-mcp

with environment variable PROPHETKEY_MCP_TOKEN=your-token-here.

3. Use it

Ask your agent: "list my available API keys" or "call my OpenAI key to summarize this".

Available tools

Tool	Description
`prophetkey_list_keys`	List stored keys (returns `safe_key` identifiers, never real keys)
`prophetkey_get_key_info`	Details for one key (name, provider, safety score, health)
`prophetkey_proxy_status`	Proxy status: running, port, keys count, request stats
`prophetkey_health_check`	Health check across all keys (expiry, usage, security)
`prophetkey_make_request`	Make an API call through the proxy — the proxy injects the real key

Configuration

Env var	Default	Description
`PROPHETKEY_MCP_TOKEN`	(required)	Bearer token from ProphetKey MCP settings
`PROPHETKEY_MCP_PORT`	`1421`	Local proxy port
`PROPHETKEY_MCP_URL`	(derived)	Full URL override: `http://127.0.0.1:1421/mcp`

Security

Keys never leave your device. All requests stay on 127.0.0.1.
The agent never sees real key values. Only safe identifiers pass through; the proxy injects the real key for the outbound call.
On-device-first: no cloud, no sync, no third party. See the privacy model for details.