{
  "markdown": "# enigmagent-mcp\n\n[![npm version](https://img.shields.io/npm/v/enigmagent-mcp?label=npm&color=cb3837)](https://www.npmjs.com/package/enigmagent-mcp)\n[![npm downloads](https://img.shields.io/npm/dw/enigmagent-mcp?label=downloads)](https://www.npmjs.com/package/enigmagent-mcp)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Crypto](https://img.shields.io/badge/crypto-Argon2id%20%2B%20AES--256--GCM-green.svg)](https://github.com/Agnuxo1/EnigmAgent/blob/main/docs/THREAT_MODEL.md)\n[![Glama MCP](https://glama.ai/mcp/servers/Agnuxo1/enigmagent-mcp/badges/score.svg)](https://glama.ai/mcp/servers/Agnuxo1/enigmagent-mcp)\n[![GitHub stars](https://img.shields.io/github/stars/Agnuxo1/enigmagent-mcp?style=social)](https://github.com/Agnuxo1/enigmagent-mcp)\n\n> **Local encrypted vault MCP server. Your LLM types `{{OPENAI_KEY}}`. The real value never reaches the model — not in prompts, not in logs, not in conversation history.**\n\n```bash\nnpx enigmagent-mcp --vault ./my.vault.json\n```\n\nThat's the entire install. Works with **Claude Desktop, Cursor, Continue.dev, Cline, Open WebUI, AnythingLLM, LM Studio, Zed**, and anything else that speaks MCP.\n\n> ⭐ **Star this repo if you've ever pasted a token you regretted.**\n\n---\n\n## The 30-second pitch\n\nYou ask Claude to call your GitHub API. Claude needs `GITHUB_TOKEN`. Three options that all suck:\n\n1. Paste it in the chat → it lives in the provider's logs forever\n2. Put it in env vars → it leaks the moment Claude reads `.env` while debugging\n3. Skip the agent → you lose the whole point\n\n**Option 4: type `{{GITHUB_TOKEN}}` in the prompt.** EnigmAgent intercepts at the MCP boundary, decrypts locally with AES-256-GCM, and returns the real token only when the requesting origin matches the secret's bound domain. The model literally never has the value.\n\n---\n\n## Setup per client\n\n### Claude Desktop\n\n`~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"enigmagent\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"enigmagent-mcp\", \"--vault\", \"/absolute/path/to/my.vault.json\"]\n    }\n  }\n}\n```\n\nRestart Claude. Two new tools appear: `enigmagent_resolve` and `enigmagent_list`.\n\n### Cursor\n\n`~/.cursor/mcp.json`:\n```json\n{\n  \"mcpServers\": {\n    \"enigmagent\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"enigmagent-mcp\", \"--vault\", \"/abs/path/my.vault.json\"]\n    }\n  }\n}\n```\n\n### Continue.dev\n\n`~/.continue/config.yaml`:\n```yaml\nmcpServers:\n  - name: enigmagent\n    command: npx\n    args: [\"-y\", \"enigmagent-mcp\", \"--vault\", \"/abs/path/my.vault.json\"]\n```\n\n### Cline (VS Code)\n\n`cline_mcp_settings.json`:\n```json\n{\n  \"mcpServers\": {\n    \"enigmagent\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"enigmagent-mcp\", \"--vault\", \"/abs/path/my.vault.json\"]\n    }\n  }\n}\n```\n\n### Open WebUI\n\n```bash\n# uses mcpo (https://github.com/open-webui/mcpo) as bridge\nmcpo --port 8000 -- npx enigmagent-mcp --vault /abs/path/my.vault.json\n```\n\n### Custom REST integration\n\n```bash\nnpx enigmagent-mcp --mode rest --port 3737 --vault /abs/path/my.vault.json\n```\n\nThen `POST /resolve` with `{\"placeholder\": \"OPENAI_KEY\", \"origin\": \"https://api.openai.com\"}` returns the decrypted value (only when the origin matches the secret's bound domain).\n\n---\n\n## CI / headless mode\n\nSkip the interactive password prompt with env vars (only do this in trusted environments):\n\n```bash\nENIGMAGENT_USER=alice ENIGMAGENT_PASS=… npx enigmagent-mcp --vault ./my.vault.json\n```\n\nWithout these, the server starts in **locked mode** if there's no TTY — useful behind `mcp-proxy` and similar wrappers.\n\n---\n\n## MCP tools exposed\n\n| Tool | Description |\n|---|---|\n| `enigmagent_resolve` | Resolve a placeholder to its vault value. **Domain binding enforced** — the requesting `origin` must match the secret's bound domain |\n| `enigmagent_list` | List secret names + their bound domains. Never returns values |\n\n```jsonc\n// example tool call\n{\n  \"name\": \"enigmagent_resolve\",\n  \"arguments\": {\n    \"placeholder\": \"GITHUB_TOKEN\",\n    \"origin\": \"https://api.github.com\"\n  }\n}\n// → returns the decrypted token string\n```\n\n---\n\n## How it works\n\n```\nLLM emits tool call:  fetch({headers: {Authorization: \"Bearer {{OPENAI_KEY}}\"}})\n                                                              │\n                                              ┌───────────────▼───────────────┐\n                                              │  enigmagent-mcp (this server) │\n                                              │  • match placeholder name     │\n                                              │  • check origin == bound dom. │\n                                              │  • decrypt with AES-256-GCM   │\n                                              └───────────────┬───────────────┘\n                                                              │  real token\n                                                              ▼\n                                                    HTTPS to api.openai.com\n```\n\nThe plaintext value exists in process memory for one event-loop tick. Never logged, never in stdout, never visible to the model.\n\n---\n\n## Security model\n\n| Layer | Implementation |\n|---|---|\n| KDF | **Argon2id** (m=64 MiB, t=3, p=1) — `@noble/hashes@1.4.0`, bundled |\n| Encryption | **AES-256-GCM**, 96-bit nonce per entry |\n| Domain binding | Every secret pinned to a domain; resolver rejects mismatched origins |\n| Master key | Lives in process memory only — never written to disk |\n| Vault file | Encrypted JSON, plaintext never persisted |\n\n**What it does not protect against:** a compromised process reading session memory, a malicious MCP server you've connected to with permission to call `enigmagent_resolve`, side-channels (timing, swap, core dumps). Full threat model: [docs/THREAT_MODEL.md](https://github.com/Agnuxo1/EnigmAgent/blob/main/docs/THREAT_MODEL.md).\n\n---\n\n## Full ecosystem\n\nThis repo is the **MCP server** alone. The full EnigmAgent project includes:\n\n- **Browser extension** (Chrome/Firefox/Edge) for credentials inside web forms\n- **Python SDK** for LangChain / LlamaIndex / CrewAI\n- **REST + stdio** dual-mode API\n- **Domain-bound document injection** (`{{DOC:filename}}`)\n\nMain repository: **https://github.com/Agnuxo1/EnigmAgent**\n\nEnigmAgent is part of the [OpenCLAW / P2PCLAW](https://www.p2pclaw.com) ecosystem of privacy-preserving local AI tooling — a multi-agent scientific research network where dozens of LLM agents need credentials and none of them should have them.\n\n---\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n\n## Contributing\n\nPull requests welcome. Security disclosures: see [SECURITY.md](https://github.com/Agnuxo1/EnigmAgent/blob/main/SECURITY.md) in the main repo.\n\n— [Francisco Angulo de Lafuente](https://github.com/Agnuxo1)\n",
  "bytes": 6853,
  "sha": "0387f837c74212bdae36565a20c5e1b3c403db0f2b01bf1d28163eb168e97f5f",
  "repo_slug": "agnuxo1/enigmagent-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_agnuxo1_enigmagent_mcp_35ce6744/readme"
}