Back to Browse

Sealkeep MCP Server

by Munhq
Developer ToolsModerate7.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Let AI agents use secrets without seeing them: inject into a command, redact the output.

About

Let AI agents use secrets without seeing them: inject into a command, redact the output.

Security Report

7.2
Moderate7.2Low Risk

sealkeep is a secrets broker that stores values in the OS keyring or Vault and injects them into subprocesses while redacting them from output, and the MCP tools (list_secrets, run_with_secrets, store_status) never return raw values. The main concern is inherent to the design: run_with_secrets lets an agent run arbitrary commands with secrets in their environment, so a malicious or manipulated agent could still exfiltrate a value through a command such as curl, and redaction only matches known value forms. The main source files for the MCP server, redaction, and postinstall logic were not included, so those parts could not be verified. Package verification found 1 issue.

4 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

What You'll Need

Set these up before or after installing:

Path of the config file (stores, aliases, guard rules). Default: the config folder of the OS. With no file, sealkeep uses the OS keyring.Optional

Environment variable: SEALKEEP_CONFIG

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-munhq-sealkeep": {
      "env": {
        "SEALKEEP_CONFIG": "your-sealkeep-config-here"
      },
      "args": [
        "-y",
        "@munhq/sealkeep"
      ],
      "command": "npx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!