API Key Case MCP server

API Key Case

Hand an AI coding agent the work, not the key. API Key Case scans a project locally, reports likely secret-handling risks, and generates redacted context for Claude Code, Codex, Cursor, and similar tools. Values live in your OS secret store, and Pro deploy places them into Cloudflare, Vercel, or GitHub through those platforms' official CLIs — a secret value is never returned, printed, or logged.

日本語版のREADMEは README.ja.md にあります。

This README describes the v0.9.2 pre-stable release candidate. @latest follows npm's published dist-tag, which can lag during staged publication. Confirm that the exact 0.9.2 package is available before using its Agent workflow; the release checklist records the gates and acceptance evidence.

This pre-stable tool reduces accidental exposure risk. It does not guarantee complete secret protection. Always review generated files before sharing them.

完全な安全は保証しない。事故確率を下げるツールです。生成物はAIや外部サービスへ渡す前に必ずご自身で確認してください。

Website · OS support status · npm · Changelog · Security · Support · Terms · Privacy · Brand and third-party notices

Quick start

The normal Agent-first support baseline is Windows 11 with Windows Hello. macOS is a collaborative verification edition: its implementation, current CI and real Keychain evidence exist, while native GUI approval, Accessibility resistance, Intel hardware and real-Mac provider deployment remain unverified. macOS verification is still in progress; do not purchase Pro relying on macOS deploy. See the OS support status and the macOS verification plan.

Requires Node.js 20 or later on Windows, macOS, or Linux. On Windows, high-risk approval, remove, and trust forget in v0.9.1 require Windows 11 build 22000 or later and Windows Hello (PIN, fingerprint, or face) set up for that account; Windows 10 and accounts without Hello fail closed for those decisions and hand off to a human instead, while scan, vault, and Secret input remain available. Because deploy is the paid feature, check that before buying. Linux supports local diagnosis, status/history, and human-owned-terminal storage when an OS store is available; Agent-first input, approval, executing deploy, and approval-required value/trust removal are not provided. Linux keyring backend selection and login/reboot persistence remain environment-dependent.

The published release's basic commands can be tried independently:

# Scan the current project locally. Real .env contents are not read.
npx -y api-key-case@latest scan .

# Generate redacted context for an AI coding agent.
npx -y api-key-case@latest scan . --agent-report

# Save a value through a hidden interactive prompt.
npx -y api-key-case@latest save OPENAI_API_KEY

# Check status only. The value is never returned.
npx -y api-key-case@latest check OPENAI_API_KEY

Never put a real secret in a command argument, Issue, chat message, or generated report. Human-owned terminal use keeps the hidden prompt; Agent-first use must request save --ask and enter the value only in the Human Plane dialog.

Start with your current .env

Shortened. The full README is on GitHub.