Enigmagent MCP server

enigmagent-mcp 2.0.0

enigmagent-mcp is a local encrypted vault server for MCP-capable clients. It stores secret values with an Argon2id-derived AES-256-GCM key and keeps the vault file encrypted at rest.

Version 2.0.0 makes the security boundary explicit:

operator passes --allow-raw-resolve or sets ENIGMAGENTALLOWRAW_RESOLVE=1.

• MCP starts in metadata-only mode. Raw secret resolution is disabled unless the

include arbitrary exception messages or permissive browser CORS.

• REST binds to 127.0.0.1 and requires a 32–256 character Bearer token.
• REST requests have bounded headers, bodies, and timeouts; responses do not

versioned KDF context enigma/v2.

• Vault writes use a temporary file, flush, replacement, and a recovery backup.
• Version 1 vaults remain readable. New vaults use format version 2 and the

Raw resolution is deliberately an opt-in escape hatch. A caller-declared origin is not proof of the network destination, and a trusted MCP client can still pass returned plaintext to its model. Do not enable raw resolution for an untrusted client or a shared process.

Install and run

npx enigmagent-mcp@2.0.0 --vault ./my.vault.json

The first run prompts for the existing vault credentials when attached to a terminal. For a trusted headless process, set ENIGMAGENTUSER and ENIGMAGENTPASS in its private environment. The server does not print either value.

MCP modes

The stdio transport implements bounded JSON-RPC MCP initialization, ping, tools/list, and tools/call. The default tool is:

• enigmagent_list: names, domains, and creation timestamps only.

With explicit raw-resolution opt-in, it additionally exposes:

the entry's domain binding.

• enigmagent_resolve: returns a value only when the requested origin matches

The origin is normalized and limited to HTTP(S) URLs without embedded user credentials. Notifications, malformed JSON, oversized frames, invalid tool arguments, and calls before initialization are handled without terminating the process.

Authenticated REST

set ENIGMAGENT_API_TOKEN=use-a-random-32-character-token-or-longer
npx enigmagent-mcp@2.0.0 --mode rest --port 3737 --vault ./my.vault.json

GET /health is a minimal unauthenticated liveness check. GET /status and GET /list require Authorization: Bearer . POST /resolve also requires the token, JSON content type, and the explicit raw-resolution flag. The service rejects browser-origin requests and binds only to loopback.

Client configuration adapters

integrations.js provides tested configuration builders for Claude Desktop, Cursor, Continue, Cline, Open WebUI, AnythingLLM, LM Studio, Zed, Goose, and Windsurf. They are maintained configuration examples using the standard MCP stdio command; they are not upstream plugins, endorsements, or claims of adoption by those projects.

Development and verification

npm ci
npm test
npm run check
npm run benchmark
npm pack --dry-run

The tests cover encrypted-at-rest behavior, domain matching, wrong credentials, version-1 migration reads, backup recovery, bounded MCP framing and session ordering, authenticated REST, and all ten configuration adapters. The benchmark uses synthetic data and reports create/add/resolve latency without printing a secret.

Release contents

The historical 1.0.5 tree is preserved in versions/1.0.5/ with its source archive and SHA-256 manifest. The 2.0.0 release is represented consistently in package.json, server.json, and manifest.json; publication remains subject to the repository's CI and release checks.

Scope and threat model

Shortened. The full README is on GitHub.