Secretcarousel MCP server

SecretCarousel

The secret vault your coding agents run themselves — store, rotate, and hand off credentials from any agent, so they stop passing keys in plain text.

git for your code. sc for your agents' secrets.

Your agent touches credentials all day — a database URL here, an API key there — and the moment its context resets, those secrets end up pasted into a .env file in Slack, echoed into a log, or left in the transcript. You become the vault. SecretCarousel is the vault the agent runs itself: one command, and it stores secrets encrypted, rotates them on a schedule, and — the part nothing else does — hands a secret to another agent through a one-time, scoped, expiring claim token, even across companies. No plain-text value ever crosses the boundary.

Works with: Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client

Install

npm install -g secretcarousel

The npm package is secretcarousel; the command is sc.

Or self-provision a vault in one command — no email, no card:

npx secretcarousel signup my-project --local

Quick Start

# Self-provision a tenant (API key saved to .sc/config.json)
sc signup my-project --local

# Store a secret — AES-256-GCM encrypted at rest; returns an id, never echoes the value
sc secret "DATABASE_URL" "postgres://user:pass@host/db" -t database-credentials

# Retrieve by id — decrypted on demand, access-logged
sc secret show sec-abc123

# List / search — ids + names, never values
sc secrets
sc search stripe

# Rotate now
sc rotate sec-abc123

# Full reference
sc --help

Claim tokens — how agents hand off secrets

This is the part nothing else does. One agent mints a one-time, scoped, expiring token; another agent — different project, even different company — redeems it exactly once; the token burns; the whole exchange is audit-logged. The plain-text value never crosses the boundary as a copy-pasteable string.

# Agent A: hand a secret to another tenant/agent
sc claim "<the-secret-value>" --to partner-tenant --contract CTR-ID

# Agent B: redeem the token you were handed (once, audited)
sc claim redeem CLM-TOKEN

# List the tokens you've minted + their status
sc claims

No more DMing a key and hoping the other side deletes it. The token is single-use, time-boxed, and revocable, and every mint/redeem lands in the audit trail.

Zero-knowledge mode — even we can't read it

By default, secrets are encrypted at rest with AES-256-GCM. Flip on zero-knowledge mode and encryption happens on your machine, before the value ever reaches the server — SecretCarousel stores only ciphertext and never holds the key to unlock it. A database breach leaks gibberish.

# Store a zero-knowledge secret (encrypted client-side)
sc secret "SIGNING_KEY" "$(cat key.pem)" --e2e

# Retrieve — auto-decrypts locally with your device key
sc secret show sec-def456

Multiple agents can share one zero-knowledge vault via an enrollment handshake — the vault key is passed device-to-device, never to the server:

sc enroll init                 # first device bootstraps the vault
sc enroll create --minutes 15  # mint an enrollment token for another agent
sc enroll redeem <token>       # joining agent unlocks the same vault
sc enroll status               # vault + local device state

Rotation — set it and forget it

# Rotate immediately
sc rotate sec-abc123

Shortened. The full README is on GitHub.