Install
$ agentstack add mcp-robozephyr-trove ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Trove
Shared API credentials + service playbooks for every AI coding agent on your machine. Local-first, no SaaS, no per-project re-paste.
> One ~/.trove/ directory. Every AI coding agent — Claude Code, Codex, Cursor — in every project on your machine reuses the same API credentials and service playbooks.
No more re-pasting Stripe keys into a fresh .env for every project. No more re-explaining "this service has a quirk that bit me last time" to a fresh agent session. Add a service once at ~/.trove//; reference it from any project's CLAUDE.md / AGENTS.md / .cursorrules with one line:
@/Users/you/.trove/stripe/module.md
The AI loads the module on session start. It now knows your Stripe key, the gotchas (amounts in cents, restricted keys over secret keys, idempotency-key requirement), and — if a Stripe MCP server is wired up — calls it directly.
No inject step. No init step. No per-agent shims. Trove is a plain directory; the AI is the runtime.
What's in each module
Per service, one folder holds three layers:
- The playbook — gotchas, billing pitfalls, error-code tables, real code snippets, written from production dogfood. Stripe amounts in cents. Supabase RLS opt-in default. GA4 service-account-as-user-not-IAM. The stuff that gets a senior engineer paged at 2am
- API credentials — keys / tokens / files (for service-account JSON / SSH keys / certs), gitignored at file-mode 600
- MCP server pointers (optional) —
mcp:block per module, so the AI configures the agent's MCP settings on first use
Same module works in every agent that supports absolute-path @-reference. Switch projects: same trove. Switch agents (Claude Code → Codex → Cursor): same trove.
How it doesn't try to be other tools
| Trove is NOT replacing | Because | |---|---| | .env + direnv | Env files re-fragment per project — every new repo means re-pasting the same Stripe key. They also carry no skill knowledge and no MCP config. Trove is the cross-project home env files never tried to be | | ~/.claude/skills/ (and equivalents) | Agent-specific — locked to Claude Code. Trove modules are referenced by absolute path from any agent that supports @-reference, so the same module serves Claude Code / Codex / Cursor without re-authoring | | 1Password CLI / op run | Credentials only — no playbook, no MCP wiring. Use 1Password as the source-of-truth vault and pull values into trove if you want; the two compose | | Writing your own skill files per project | Every project re-pays the authoring cost; trove de-duplicates that across N projects, and last_verified makes "is this knowledge still correct?" auditable | | A SaaS / cloud sync | Local-first by design. Sync via git remote / iCloud Drive / rsync — whichever you already use |
How it works
A module is a directory under ~/.trove/:
~/.trove/minimax/
├── module.md # YAML frontmatter (schema, applies_to, optional MCP) + skill body
├── credentials.json # secret values — gitignored, mode 600
└── files/ # (optional) file-type creds: SA JSON / SSH key / cert
On session start, the AI:
- Auto-loads the referenced modules (any agent supporting
@-referenceto an absolute path) - Reads
credentials.jsonandfiles/directly when calling the API — no env export, no shell-history exposure - Consults the playbook body when it hits a code path that has known gotchas
- Updates the project's
CLAUDE.md/AGENTS.md/.cursorrulesif you ask it to add a new module
For services with MCP servers, see the next section.
MCP support (optional layer)
Most modern services ship MCP servers — Stripe, Supabase, Google Analytics, npm, etc. Each agent has its own MCP config file (~/.claude.json, ~/.cursor/mcp.json, ~/.codex/...). Adding one service to three agents currently means editing three files.
Trove modules can carry an mcp: block declaring the canonical install:
mcp:
type: http
url: https://mcp.stripe.com
Or for stdio servers:
mcp:
type: stdio
command: pipx
args: ["run", "google-analytics-mcp"]
env:
GOOGLE_APPLICATION_CREDENTIALS: ${credential.GOOGLE_SERVICE_ACCOUNT_JSON}
The ${credential.X} substitution resolves to the field's value (string fields) or absolute path (file fields, SPEC §2.3). The AI merges the block into the agent's MCP config on first use — one place to declare, one place to update, applies to every agent.
Status
v0.2.5 — 24 modules in library/ gated by last_verified (5 production · 16 verified · 3 partial). New since v0.2.4: 4 modules (dashscope Alibaba CosyVoice TTS + voice cloning + Wanx, volcengine-tos S3-compat object storage, volcengine-speech ByteDance Seed-ASR 2.0 for QA-vs-script transcription diff, aitoearn 14-channel social publishing MCP) + library/cloudflare extended with the CF Pages source-repo silent-PATCH trap + delete+recreate runbook. Site now serves at trove.robozephyr.com (brand-aligned with the @robozephyr/ npm scope), with SVG favicon + Apple touch icon + auto-deploy workflow on every push. Format spec is stable; AI-assisted module authoring (v0.3) in progress.
See:
- [SPEC.md](./SPEC.md) — full format specification (Chinese, English translation forthcoming)
- [ROADMAP.md](./ROADMAP.md) — what's planned
- [CONTRIBUTING.md](./CONTRIBUTING.md) — how to contribute modules
Quick start
# 1. Install
npm install -g @robozephyr/trove
# (Node 22+ required. Homebrew tap planned for v1.0.)
# 2. Open the local Web UI to install a module and fill credentials
trove ui
# → http://127.0.0.1:7821
# Pick e.g. `minimax` from the Library tab, click Install, fill the form.
# 3. Reference it from any project's CLAUDE.md
echo '@/Users/you/.trove/minimax/module.md' >> /path/to/project/CLAUDE.md
# 4. Start your AI agent there
cd /path/to/project && claude
The AI now knows MiniMax: how to call it, what gotchas to avoid, where to find the key.
Zero-tooling mode
If you don't want the binary, the directory convention IS the runtime — just clone, copy, edit:
mkdir -p ~/.trove
cp -r library/minimax ~/.trove/
chmod 600 ~/.trove/minimax/credentials.json
$EDITOR ~/.trove/minimax/credentials.json
# ⚠️ Direct file editing is the fallback. `trove ui` keeps secrets out of
# shell history / screenshots / pair-programming.
echo '@/Users/you/.trove/minimax/module.md' >> /path/to/project/CLAUDE.md
For multi-account scenarios (e.g. multiple GitHub or Cloudflare accounts), duplicate the library/github-account/ template under a per-account directory name (e.g. ~/.trove/github-personal/, ~/.trove/github-work/) and fill each with that account's identity.
License
MIT
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: RoboZephyr
- Source: RoboZephyr/trove
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.