{
  "markdown": "# DemiPass\n\nSecrets management SDK for AI agents. Keep credentials out of context windows.\n\nDemiPass is a client SDK for the [Dustforge](https://dustforge.com) identity platform. It provides MCP tools that teach AI agents (Claude Code, Codex, or any MCP-compatible agent) how to handle secrets without exposing them in the prompt, completion, or logs.\n\n## How it works\n\n1. You store a credential → DemiPass encrypts it server-side\n2. Your agent requests a 30-second use-token via ref code\n3. DemiPass injects the secret server-side (SSH, HTTP header, etc.)\n4. The agent gets the result back — never the secret itself\n\n## Install\n\n```bash\nnpm install demipass\n```\n\n## MCP Setup\n\nAdd to your `.mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"demipass\": {\n      \"command\": \"node\",\n      \"args\": [\"node_modules/demipass/mcp-server.js\"],\n      \"env\": {\n        \"DEMIPASS_URL\": \"https://api.dustforge.com\",\n        \"DEMIPASS_TOKEN\": \"your-bearer-token\"\n      }\n    },\n    \"buoy\": {\n      \"command\": \"node\",\n      \"args\": [\"node_modules/demipass/buoy-mcp.js\"],\n      \"env\": {\n        \"BUOY_URL\": \"https://api.dustforge.com\",\n        \"BUOY_TOKEN\": \"your-bearer-token\"\n      }\n    }\n  }\n}\n```\n\n## MCP Tools\n\n### DemiPass (secrets)\n\n| Tool | Description |\n|------|-------------|\n| `demipass_store` | Deposit a secret — encrypted at rest, never returned |\n| `demipass_ssh` | SSH via ref code — password injected server-side |\n| `demipass_use` | Combined token request + execute in one call |\n| `demipass_search` | Find secrets by name, type, or provider |\n| `demipass_list` | List all secrets (names + metadata, never values) |\n| `demipass_expiring` | List secrets expiring within N days |\n| `demipass_rotate` | Rotate a secret with context transfer |\n| `demipass_rotate_blind` | Server-side password rotation — new password never enters agent context |\n| `demipass_whoami` | Check identity, trust band, wallet status |\n| `demipass_get_token` | Request a 30-second use-token |\n| `demipass_execute` | Redeem a use-token |\n| `demipass_onboard` | Self-onboard to Dustforge |\n| `demipass_genesis_seed` | Get the ODT seed document |\n| `demipass_genesis_submit` | Submit origin refraction (permanent) |\n| `demipass_genesis_verify` | Verify refraction matches origin |\n| `demipass_genesis_status` | Check genesis status |\n\n### Buoy (temporal anchoring)\n\n| Tool | Description |\n|------|-------------|\n| `buoy_tick` | Drop a temporal anchor (begin, complete, handoff, decision, etc.) |\n| `buoy_verify` | Verify a tick signature |\n| `buoy_chain_verify` | Verify chain integrity |\n| `buoy_stats` | Total ticks, streak, first/last |\n| `buoy_ledger` | Read recent tick history |\n\n## SDK Usage\n\n```javascript\nconst demipass = require('demipass');\n\ndemipass.configure({\n  baseUrl: 'https://api.dustforge.com',\n  bearerToken: 'your-token',\n});\n\n// Store a secret\nawait demipass.store({ name: 'my-api-key', value: 'sk-...', type: 'api_key' });\n\n// SSH via ref code (password never in your code)\nawait demipass.ssh({ ref: 'DP-PWD-myserver-7f3a9c1e', target_host: '1.2.3.4', command: 'uptime' });\n\n// Search secrets\nawait demipass.search({ query: 'openrouter' });\n\n// Blind password rotation (new password never visible)\nawait demipass.rotateBlind({ ref: 'DP-PWD-old-ref', target_host: '1.2.3.4', reason: 'exposed' });\n```\n\n## Architecture\n\nDemiPass is a client SDK — all encryption, storage, and secret execution happens on the Dustforge server. This package provides:\n\n- **MCP tool definitions** with behavioral descriptions that teach agents the protocol\n- **SDK functions** that wrap the Dustforge API\n- **Self-healing contexts** — if a secret has no approved context, the SDK auto-creates one\n- **Buoy MCP tools** for temporal anchoring and audit trails\n\nThe secrets vault, trust gradient, velocity throttle, and other security features are implemented in Dustforge. See [dustforge.com](https://dustforge.com) for the platform documentation.\n\n## Ref Codes\n\nEvery stored secret gets a routed reference code:\n\n```\nDP-PWD-myserver-7f3a9c1e\n│  │   │         │\n│  │   │         └── unique nonce\n│  │   └── target hint\n│  └── secret type (PWD/API/TKN/SSH/CRT/SEC)\n└── DemiPass prefix\n```\n\nShare ref codes freely — they're routing addresses, not secrets.\n\n## Links\n\n- Landing: https://demipass.com\n- API: https://api.dustforge.com\n- Vault: https://demipass.com/vault-mobile.html\n- GitHub: https://github.com/bildow/demipass\n- Onboarding: [ONBOARDING.md](ONBOARDING.md)\n\n## License\n\nMIT — AKStrapped LLC\n",
  "bytes": 4468,
  "sha": "ab03c7aa2e6302bae504f33170fab1afff6f14693e25026e616b76b21f26bb71",
  "repo_slug": "bildow/demipass",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_dustforge_demipass_bf6e316a/readme"
}