Keyblind
by aarifmmscommunityv0.1.4
1
Keyblind is a local encrypted secrets vault with an MCP server for AI agents, letting them resolve secrets at runtime without exposing plaintext values in chat transcripts. It also provides CLI commands for storing, listing, sandboxing, sharing, and injecting secrets into commands.
From the registry: Encrypted secrets vault for AI agents — secrets resolved at runtime, never seen by LLMs.
Install & configure
Prerequisites
- requiredInstall Keyblind CLIInstall the Keyblind package globally via npm so the `keyblind` command is available.
https://www.npmjs.com/package/keyblind/$ npm i -g keyblind - requiredInitialize your vaultCreate and initialize the local encrypted Keyblind vault before using the MCP server.
$ keyblind init - optionalActivate Pro/Team license for biometric modeOnly needed if you want to run the MCP server with `--biometric`. The README states biometric gate requires a Pro or Team license.
https://keyblind.dev$ keyblind activate <your-license-key>
Install in your client
Paste into the AI you're chatting with — it will figure out the rest
Please install the `keyblind` MCP server into my current AI client (that's you).
Required prerequisites (do these first if not already done):
- **Install Keyblind CLI** — Install the Keyblind package globally via npm so the `keyblind` command is available. Run: `npm i -g keyblind` (https://www.npmjs.com/package/keyblind/)
- **Initialize your vault** — Create and initialize the local encrypted Keyblind vault before using the MCP server. Run: `keyblind init`
Optional prerequisites:
- Activate Pro/Team license for biometric mode — Only needed if you want to run the MCP server with `--biometric`. The README states biometric gate requires a Pro or Team license. Run: `keyblind activate <your-license-key>` (https://keyblind.dev)
Canonical MCP server config (stdio transport):
- command: `keyblind`
- args: ["start"]
Note: Manual MCP server command is `keyblind start` for stdio transport. An optional biometric mode is also documented as `keyblind start --biometric`, which requires prior `keyblind unlock` authentication and a Pro or Team license. The README also documents `keyblind start --http`, but that is for the web dashboard rather than the MCP client setup shown here.
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.Note: Manual MCP server command is `keyblind start` for stdio transport. An optional biometric mode is also documented as `keyblind start --biometric`, which requires prior `keyblind unlock` authentication and a Pro or Team license. The README also documents `keyblind start --http`, but that is for the web dashboard rather than the MCP client setup shown here.
Tools (16)
resolve_secret
Resolve a secret at runtime while keeping the value hidden from the transcript
store_secret
Encrypt and store a secret
list_secrets
List secret names without revealing values
delete_secret
Delete a secret
sandbox_env
Replace .env values with deterministic fake values
unsandbox_env
Restore real .env values from the vault
audit_log
View the secret resolution audit trail
totp_code
Generate a TOTP 2FA code for a stored configuration
totp_store
Store a TOTP configuration from an otpauth:// URI
totp_list
List stored TOTP configurations
totp_delete
Delete a TOTP configuration
create_share_link
Create an encrypted, expiring share link for a secret
receive_share
Receive and decrypt a shared secret
deadman_status
Check dead man's switch status
Packages
keyblind
npmv0.1.4transport: stdio
Details
- Language
- TypeScript
- License
- MIT
- Released
- May 27, 2026
- Last commit
- May 29, 2026
- Registry name
- io.github.aarifmms/keyblind