NIM Key Manager MCP server

NIM Key Manager

Self-hosted, production-ready manager for the API keys of your own NVIDIA Build/NIM account — encrypted storage, assisted rotation, expiry detection, usage stats, projects, RBAC, audit, a web dashboard, and a Claude MCP connector. Deploy your own instance in a few minutes; everything is configured through environment variables.

NVIDIA Terms of Service. NVIDIA Build offers no public API to create or rotate keys programmatically (you generate them at build.nvidia.com), and API keys must not be shared or redistributed to third parties. This project is therefore designed for you to manage your own keys on your own instance: the only outbound call is the official read-only validation endpoint GET https://integrate.api.nvidia.com/v1/models. It does not automate or scrape the NVIDIA portal, and it is not a service for handing your keys to other people.

Deploy your own (no local setup)

1. Click the button (or Use this template → Create repository, then in Render pick New → Blueprint and select your fork). Render reads render.yaml and provisions everything automatically:

• a managed PostgreSQL database,
• the Dockerized web service with a health check,
• the secrets JWTSECRET, ENCRYPTIONMASTERKEY and MCPOAUTHJWTSIGNING_KEY (generated and stored by Render's secret manager),
• DATABASE_URL injected from the database.

1. When prompted, set FIRSTADMINEMAIL and FIRSTADMINPASSWORD (your initial admin, created on first boot).
2. Open the service URL: log in at /, explore the API at /docs.
3. Every push to main runs CI (lint + types + tests + build) and redeploys automatically. Migrations (alembic upgrade head) run on container start.

Prefer another host? Any platform that runs a Docker container + PostgreSQL works — see docs/deployment.md.

Use it from Claude (MCP connector)

The same deployment exposes a Model Context Protocol server at ‹BASE›/mcp so you can add it to Claude as a custom connector. Claude authenticates with OAuth 2.1 (GitHub by default, Google optional) and can list/inspect keys, dispense a ready-to-use key, register/rotate/revoke and manage projects — with the same RBAC and audit trail as the REST API. Only identities in MCPALLOWEDIDENTITIES may connect (fail-closed).

1. Create a GitHub OAuth App with callback ‹BASE›/auth/callback; copy the Client ID/Secret.
2. In Render set MCPGITHUBCLIENTID, MCPGITHUBCLIENTSECRET and MCPALLOWEDIDENTITIES (your GitHub login/e-mail). The rest is already in render.yaml.
3. In Claude: Settings → Connectors → Add custom connector → URL ‹BASE›/mcp → Connect.

Full guide (Google, tool reference, security, troubleshooting): docs/connector.md.

Features

Shortened. The full README is on GitHub.