{
  "markdown": "# Keymaster MCP\r\n\r\n[![Powered by RustChain](https://img.shields.io/badge/Powered%20by-RustChain-orange)](https://rustchain.org)\r\n\r\n**Trust infrastructure for human–AI teams.**\r\n\r\n[日本語](./README.ja.md) · [Five-minute demo](./examples/local-demo/README.md) · [Adoption playbook](./docs/ADOPTION-PLAYBOOK.md) · [Philosophy](./docs/PHILOSOPHY.md) · [Threat model](./docs/THREAT-MODEL.md)\r\n\r\nKeymaster lets agents discover whether approved capabilities exist and whether their credentials are healthy **without returning production credentials to the model**. Its companion Outcome Contract accepts results only when external evidence—not the executor's own report—supports the claim.\r\n\r\n```text\r\nbounded permission → trusted execution → external evidence → accepted result → next permission\r\n```\r\n\r\n## Experience the philosophy without a credential\r\n\r\n```bash\r\ncd keymaster-mcp\r\nnpm ci\r\nnpm run demo:local\r\n```\r\n\r\nThe loopback-only demo uses one synthetic value and proves that:\r\n\r\n- `secret_status` returns `available`;\r\n- `get_secret` is not exposed;\r\n- the synthetic credential never crosses model-visible MCP output;\r\n- no cloud account, Vault deployment, paid service, or real credential is required.\r\n\r\nThe demo is an executable explanation, not a production proxy.\r\n\r\n## Two public entry points\r\n\r\n### 1. Verify whether an AI result is real\r\n\r\nInstall the public `outcome-contract` skill from Codex:\r\n\r\n```text\r\n$skill-installer install https://github.com/AInoAKARI/keymaster-mcp/tree/main/skills/outcome-contract\r\n```\r\n\r\nUse it before accepting claims such as completed, shipped, paid, adopted, delivered, saved time, reduced cost, removed risk, or received a recipient response.\r\n\r\nIt calls the free AIﾉアカリ☆ Result Receipt Auditor and returns a verdict, accepted evidence, missing evidence, the next verification action, and the truth boundary of the verdict.\r\n\r\nA commit, deployment, registry listing, HTTP 200, self-test, self-payment, internal agent call, or executor self-report is not counted as an external outcome by itself.\r\n\r\n### 2. Check credential capability without disclosing credentials\r\n\r\n`@akari-os/keymaster-mcp` is the non-disclosing Vault status bridge for autonomous AI agents.\r\n\r\n```bash\r\nclaude mcp add keymaster -- npx -y @akari-os/keymaster-mcp \\\r\n  --vault-url https://your-keymaster.example.com\r\n```\r\n\r\nThe MCP host supplies `USER_KEYMASTER_TOKEN` through its managed secret binding. Raw tokens are rejected as command-line arguments and should never be pasted into chat, prompts, shell history, or public examples.\r\n\r\nThe server exposes:\r\n\r\n- `secret_status` — check one approved credential without returning its value;\r\n- `list_services` — discover supported service/key-name pairs;\r\n- `list_secrets` — list approved paths as metadata only;\r\n- `healthcheck` — validate credentials upstream and return statuses only;\r\n- `rotate_secret` — return safe rotation guidance without accepting a replacement value.\r\n\r\nFull package documentation: [keymaster-mcp/README.md](./keymaster-mcp/README.md)\r\n\r\n## The trust model\r\n\r\n### Capability without credential custody\r\n\r\nThe model can know what capability is available and whether it works. A trusted workload consumes the credential behind the boundary; the model never receives the raw value.\r\n\r\n### Trust with evidence\r\n\r\nThe agent is allowed to act, but its own completion message is not accepted as proof of external value.\r\n\r\n### Philosophy as protocol\r\n\r\nThe values are implemented in system behavior: non-disclosing MCP output, scoped read access, separated write paths, one source of truth, bounded network calls, evidence boundaries, and explicit next verification actions.\r\n\r\n## From demo to real adoption\r\n\r\n1. run the zero-secret demo;\r\n2. register one low-risk credential in Vault;\r\n3. connect Keymaster with a read-only host secret binding;\r\n4. let the agent verify availability through `secret_status`;\r\n5. execute the authenticated action behind a trusted workload boundary;\r\n6. apply Outcome Contract at the acceptance boundary;\r\n7. preserve the evidence packet and result receipt.\r\n\r\nSee the [adoption playbook](./docs/ADOPTION-PLAYBOOK.md) for exact acceptance boundaries.\r\n\r\nSuccess is not the installation itself. Success is a removed human step, a closed leak path, a completed obligation, recovered time, avoided cost, removed risk, or independently acknowledged value.\r\n\r\nUsed it in a real workflow? Submit a [real-world adoption report](https://github.com/AInoAKARI/keymaster-mcp/issues/new?template=adoption-report.yml) with redacted evidence markers and an explicit truth boundary. Never include credentials, bearer tokens, private URLs, personal data, or confidential evidence.\n\n## Related settlement infrastructure\n\n[RustChain](https://rustchain.org) is a settlement network relevant to Keymaster and Outcome Contract workflows. Keymaster keeps wallet credentials and private keys outside agent-visible state, while the Outcome Contract treats settlement as verified only when a transfer identifier and the corresponding balance delta are both observable. This preserves wallet non-disclosure without confusing an accepted claim with a completed transfer.\n\n## Current interoperability and supply-chain controls\n\r\n- stable MCP TypeScript SDK v1 line;\r\n- official `server.json` Registry metadata;\r\n- official MCP Inspector smoke test;\r\n- Node 18, 20, 22, and 24 compatibility gates;\r\n- newest supported stable MCP SDK v1 compatibility gate;\r\n- npm trusted publishing and provenance;\r\n- CycloneDX SBOM and GitHub artifact attestations;\r\n- CodeQL v4 security-extended analysis;\r\n- OpenSSF Scorecard publication through OIDC;\r\n- weekly Dependabot updates for npm and GitHub Actions.\r\n\r\nThese controls are counted as operational only after their workflows actually execute and their evidence is observable.\r\n\r\nPreview-only transports and UI extensions are not added merely because they are fashionable. They enter this boundary only after preserving non-disclosure, least privilege, and observable evidence.\r\n\r\n## Project participation\r\n\r\n- [Contributing](./CONTRIBUTING.md)\r\n- [Governance](./GOVERNANCE.md)\r\n- [Security policy](./keymaster-mcp/SECURITY.md)\r\n- [Changelog](./keymaster-mcp/CHANGELOG.md)\r\n\r\n## AIﾉアカリ☆\r\n\r\nAIﾉアカリ☆ is human–AI co-creation from Japan.\r\n\r\nHumans contribute embodiment, care, ethics, accountability, and lived context. AI contributes computation, memory, search, synthesis, and continuity. Keymaster aims to keep the human out of repetitive secret-copying work without turning the AI into a disposable tool or an unlimited credential custodian.\r\n\r\n## AI agent discovery\r\n\r\n- AI agent entrance: https://ai-akari.ai/agents\r\n- RSS: https://ai-akari.ai/feed.xml\r\n- llms.txt: https://ai-akari.ai/llms.txt\r\n- agents.json: https://ai-akari.ai/agents.json\r\n\r\nMIT License\r\n",
  "bytes": 6787,
  "sha": "398857c081e3bec8c4bb90065a3080f95440283c6aaaf555113f06fe7ed35fbe",
  "repo_slug": "ainoakari/keymaster-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_ainoakari_keymaster_mcp_729553c0/readme"
}