Tremelay MCP server

Tremelay

A local credential broker, so your AI agents can use your credentials without ever seeing them.

You already give agents real authority: read these issues, push this branch, call that API. Today that means pasting a token into a config file, an environment variable, or an MCP server, and hoping nothing logs it, echoes it, or wanders off to the wrong host with it.

Tremelay splits possession of a secret from authority to use it. You keep credentials in a local encrypted vault. Each agent gets its own identity and its own narrow, expiring, revocable grants — "GET anything under https://api.github.com/repos/you/yourrepo with this token", "authenticate to git.example.com as git with this SSH key". The agent asks Tremelay to perform the operation; Tremelay performs it with the credential and returns only the result the grant allows. The agent never receives the secret, there is no getSecret tool to call, and every attempt — allowed or denied — lands in a hash-chained audit log.

The broker possesses secrets. Agents possess capabilities.

Agents connect over MCP (listcapabilities, describecapability, invoke_capability), or over an ssh-agent socket for SSH signing. Everything is local: one SQLite vault file, one user-only socket or named pipe, no server, no account, no telemetry.

Demo

A real session against a throwaway vault. The secret is the literal string dummy-demo-secret. Every command except vault create also writes one vault_unlock id=… result=allowed line to stderr; those are trimmed here, nothing else is.

$ tremelay vault create --path demo.db
vault_create id=d8df6f8230cf55a9a8b1b7c7df424f1a result=allowed
vault created

$ CRED=$(tremelay credential put --path demo.db --label "demo api key" --type api_key --secret-file ./secret)
credential_put id=649cee93880ae731b17ea858a439d7fe type=api_key result=allowed reasons=
health_assess id=649cee93880ae731b17ea858a439d7fe type=api_key result=allowed reasons=
649cee93880ae731b17ea858a439d7fe

$ AGENT=$(tremelay agent create --path demo.db --label claude-code)
agent_create agent=3a0f2de100565eb2e4be158fdb9a8201 grant= result=allowed
3a0f2de100565eb2e4be158fdb9a8201

$ GRANT=$(tremelay grant create --path demo.db --agent $AGENT --credential $CRED \
    --operation http_broker --resource https://api.github.com/repos/CharitonMedia/Tremelay \
    --method GET --inject bearer --expires 2030-01-01T00:00:00Z)
grant_create agent=3a0f2de100565eb2e4be158fdb9a8201 grant=a0f8b04d64d8ece4a56130feb2607ce9 result=allowed
a0f8b04d64d8ece4a56130feb2607ce9

$ tremelay capability list --path demo.db --agent $AGENT
capability_list agent=3a0f2de100565eb2e4be158fdb9a8201 grant= result=allowed
{"grant_id":"a0f8b04d64d8ece4a56130feb2607ce9","agent_id":"3a0f2de100565

Shortened. The full README is on GitHub.