# Enigmagent Mcp > Local encrypted vault MCP server. AES-256-GCM + Argon2id. Resolves {{PLACEHOLDER}} secrets at runtime so LLMs never see real API keys. Works with Claude Desktop, Cursor, Continue.dev, Cline, Open WebUI. - **Type:** MCP server - **Install:** `agentstack add mcp-agnuxo1-enigmagent-mcp` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [Agnuxo1](https://agentstack.voostack.com/s/agnuxo1) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 1.0.2 - **License:** MIT - **Upstream author:** [Agnuxo1](https://github.com/Agnuxo1) - **Source:** https://github.com/Agnuxo1/enigmagent-mcp - **Website:** https://www.npmjs.com/package/enigmagent-mcp ## Install ```sh agentstack add mcp-agnuxo1-enigmagent-mcp ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # enigmagent-mcp [](https://www.npmjs.com/package/enigmagent-mcp) [](https://www.npmjs.com/package/enigmagent-mcp) [](https://opensource.org/licenses/MIT) [](https://github.com/Agnuxo1/EnigmAgent/blob/main/docs/THREAT_MODEL.md) [](https://glama.ai/mcp/servers/Agnuxo1/enigmagent-mcp) [](https://github.com/Agnuxo1/enigmagent-mcp) > **Local encrypted vault MCP server. Your LLM types `{{OPENAI_KEY}}`. The real value never reaches the model — not in prompts, not in logs, not in conversation history.** ```bash npx enigmagent-mcp --vault ./my.vault.json ``` That's the entire install. Works with **Claude Desktop, Cursor, Continue.dev, Cline, Open WebUI, AnythingLLM, LM Studio, Zed**, and anything else that speaks MCP. > ⭐ **Star this repo if you've ever pasted a token you regretted.** --- ## The 30-second pitch You ask Claude to call your GitHub API. Claude needs `GITHUB_TOKEN`. Three options that all suck: 1. Paste it in the chat → it lives in the provider's logs forever 2. Put it in env vars → it leaks the moment Claude reads `.env` while debugging 3. Skip the agent → you lose the whole point **Option 4: type `{{GITHUB_TOKEN}}` in the prompt.** EnigmAgent intercepts at the MCP boundary, decrypts locally with AES-256-GCM, and returns the real token only when the requesting origin matches the secret's bound domain. The model literally never has the value. --- ## Setup per client ### Claude Desktop `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows): ```json { "mcpServers": { "enigmagent": { "command": "npx", "args": ["-y", "enigmagent-mcp", "--vault", "/absolute/path/to/my.vault.json"] } } } ``` Restart Claude. Two new tools appear: `enigmagent_resolve` and `enigmagent_list`. ### Cursor `~/.cursor/mcp.json`: ```json { "mcpServers": { "enigmagent": { "command": "npx", "args": ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"] } } } ``` ### Continue.dev `~/.continue/config.yaml`: ```yaml mcpServers: - name: enigmagent command: npx args: ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"] ``` ### Cline (VS Code) `cline_mcp_settings.json`: ```json { "mcpServers": { "enigmagent": { "command": "npx", "args": ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"] } } } ``` ### Open WebUI ```bash # uses mcpo (https://github.com/open-webui/mcpo) as bridge mcpo --port 8000 -- npx enigmagent-mcp --vault /abs/path/my.vault.json ``` ### Custom REST integration ```bash npx enigmagent-mcp --mode rest --port 3737 --vault /abs/path/my.vault.json ``` Then `POST /resolve` with `{"placeholder": "OPENAI_KEY", "origin": "https://api.openai.com"}` returns the decrypted value (only when the origin matches the secret's bound domain). --- ## CI / headless mode Skip the interactive password prompt with env vars (only do this in trusted environments): ```bash ENIGMAGENT_USER=alice ENIGMAGENT_PASS=… npx enigmagent-mcp --vault ./my.vault.json ``` Without these, the server starts in **locked mode** if there's no TTY — useful behind `mcp-proxy` and similar wrappers. --- ## MCP tools exposed | Tool | Description | |---|---| | `enigmagent_resolve` | Resolve a placeholder to its vault value. **Domain binding enforced** — the requesting `origin` must match the secret's bound domain | | `enigmagent_list` | List secret names + their bound domains. Never returns values | ```jsonc // example tool call { "name": "enigmagent_resolve", "arguments": { "placeholder": "GITHUB_TOKEN", "origin": "https://api.github.com" } } // → returns the decrypted token string ``` --- ## How it works ``` LLM emits tool call: fetch({headers: {Authorization: "Bearer {{OPENAI_KEY}}"}}) │ ┌───────────────▼───────────────┐ │ enigmagent-mcp (this server) │ │ • match placeholder name │ │ • check origin == bound dom. │ │ • decrypt with AES-256-GCM │ └───────────────┬───────────────┘ │ real token ▼ HTTPS to api.openai.com ``` The plaintext value exists in process memory for one event-loop tick. Never logged, never in stdout, never visible to the model. --- ## Security model | Layer | Implementation | |---|---| | KDF | **Argon2id** (m=64 MiB, t=3, p=1) — `@noble/hashes@1.4.0`, bundled | | Encryption | **AES-256-GCM**, 96-bit nonce per entry | | Domain binding | Every secret pinned to a domain; resolver rejects mismatched origins | | Master key | Lives in process memory only — never written to disk | | Vault file | Encrypted JSON, plaintext never persisted | **What it does not protect against:** a compromised process reading session memory, a malicious MCP server you've connected to with permission to call `enigmagent_resolve`, side-channels (timing, swap, core dumps). Full threat model: [docs/THREAT_MODEL.md](https://github.com/Agnuxo1/EnigmAgent/blob/main/docs/THREAT_MODEL.md). --- ## Full ecosystem This repo is the **MCP server** alone. The full EnigmAgent project includes: - **Browser extension** (Chrome/Firefox/Edge) for credentials inside web forms - **Python SDK** for LangChain / LlamaIndex / CrewAI - **REST + stdio** dual-mode API - **Domain-bound document injection** (`{{DOC:filename}}`) Main repository: **https://github.com/Agnuxo1/EnigmAgent** EnigmAgent is part of the [OpenCLAW / P2PCLAW](https://www.p2pclaw.com) ecosystem of privacy-preserving local AI tooling — a multi-agent scientific research network where dozens of LLM agents need credentials and none of them should have them. --- ## License MIT — see [LICENSE](LICENSE). ## Contributing Pull requests welcome. Security disclosures: see [SECURITY.md](https://github.com/Agnuxo1/EnigmAgent/blob/main/SECURITY.md) in the main repo. — [Francisco Angulo de Lafuente](https://github.com/Agnuxo1) ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [Agnuxo1](https://github.com/Agnuxo1) - **Source:** [Agnuxo1/enigmagent-mcp](https://github.com/Agnuxo1/enigmagent-mcp) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/enigmagent-mcp Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v1.0.2 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** yes - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **1.0.2** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-agnuxo1-enigmagent-mcp - Seller: https://agentstack.voostack.com/s/agnuxo1 - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.