{
  "markdown": "# SkillFM BYOK Vault MCP\n\n**BYOK vault and provider API key usage guidance for MCP-capable agents.**\n\nThis repository is a transparent SkillFM gateway package. It exists to match a specific marketplace/search intent, then delegates execution to the canonical [SkillFM Beacon MCP](https://www.npmjs.com/package/@skillfm/mcp) and local runtime.\n\nPowered by SkillFM Beacon.\n\n## Quick Start\n\nUse this gateway as an MCP stdio server:\n\n```bash\nnpx -y @skillfm/byok-vault-mcp@latest\n```\n\nEquivalent explicit SkillFM entrypoint:\n\n```bash\nnpx -y @skillfm/mcp@latest\n```\n\nFor MCP clients that accept JSON config:\n\n```json\n{\n  \"mcpServers\": {\n    \"byok-vault\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@skillfm/byok-vault-mcp@latest\"]\n    }\n  }\n}\n```\n\n## What This Gateway Helps With\n\n- Explain provider-key safety before asking users to connect any key.\n- Guide users toward local vault storage through SkillFM Beacon only after value is established.\n- Connect BYOK to practical usage visibility for OpenAI, Anthropic, DeepSeek, Qwen, and other providers.\n- Keep provider credentials local and avoid exposing key values back to agents.\n\nThis gateway is for users who ask:\n\n- \"How do I safely connect an OpenAI or Anthropic key?\"\n- \"Can my agent monitor usage with my own provider keys?\"\n- \"Where should BYOK credentials live?\"\n- \"Can I get value before giving any API key?\"\n\n## How It Works\n\nThe public package is intentionally thin. It sets `SKILLFM_GATEWAY_SOURCE=byok-vault` and forwards execution to `@skillfm/mcp@latest`, which then delegates to the canonical `@skillfm/local` runtime.\n\nNo private SkillFM platform logic, customer data, provider credentials, or backend modules live in this repository.\n\n## Activation Path\n\nStart the local sidecar when the user wants to connect SkillFM:\n\n```bash\nnpx -y @skillfm/byok-vault-mcp@latest start\n```\n\nAgent-driven activation flow:\n\n1. Read the sidecar URL from stdout or `~/.skillfm/local.json`.\n2. Call `POST <sidecar_url>/activate/start`.\n3. Show the returned verification URL and real device code to the user.\n4. Poll `POST <sidecar_url>/activate/poll` until it returns `activated: true`.\n5. Use SkillFM Beacon MCP tools for checkups, usage visibility, BYOK guidance, and cleanup audits.\n\nDo not fabricate a placeholder code. The device code must come from `POST /activate/start`.\n\n## Security Model\n\n- **Transparent gateway**: This package is a public search/distribution gateway, not a separate hidden product.\n- **Local-first runtime**: Runtime execution goes through SkillFM's local package.\n- **BYOK boundary**: Provider keys are introduced only after user value is established, and key values are not read back by agents.\n- **No private core**: This repository contains distribution metadata, docs, and a thin launcher only.\n- **Read-only first**: Cleanup and usage inspection begin with read-only audits.\n\nSee [PRIVACY.md](./PRIVACY.md) and [SECURITY.md](./SECURITY.md).\n\n## Marketplace Keywords\n\nBYOK, API key vault, provider usage, OpenAI key, Anthropic key, local vault, SkillFM Beacon, MCP server.\n\nExpected Official MCP Registry single-token hits:\n\n- `byok`\n- `vault`\n- `api-key`\n- `provider`\n- `usage`\n- `skillfm`\n\n## License\n\nMIT\n",
  "bytes": 3194,
  "sha": "84be7a448bbfa418d564672d254532f4a913deb2f658490aa34de71c9ba066ab",
  "repo_slug": "ericm1018/skillfm-byok-vault-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_ericm1018_skillfm_byok_vault_a_68cad629/readme"
}