keypaste: a secrets vault that asks before an agent reads
keypaste
A CLI and MCP bridge over a KeePass-compatible vault: an agent gets one secret only after your answer, and every request lands in a log
- 839 ★ on the repository
- Last commit
- AGPL-3.0
Broad access
Why this level
- The tool handles passwords, tokens and keys, and a value handed to an agent enters the model context and reaches its provider
- The agent writes the reason for a request itself: the person answering must check it every time
- The published binaries are unsigned and not notarized, and the pre-1.0 version carries known limitations
Install
- Works in
Manual install
curl -fLO https://dl.keypaste.com/v0.3.0/keypaste-0.3.0-osx-arm64.tar.gz && curl -fLO https://dl.keypaste.com/v0.3.0/keypaste-0.3.0-osx-arm64.tar.gz.sha256 && shasum -a 256 -c keypaste-0.3.0-osx-arm64.tar.gz.sha256 && tar -xzf keypaste-0.3.0-osx-arm64.tar.gz && mkdir -p ~/.local/bin && mv keypaste keypaste-mcp ~/.local/bin/The example is for macOS on Apple Silicon. Linux and Windows use different commands: on Linux the archive is keypaste-0.3.0-linux-x64.tar.gz, on Windows it is a zip. The checksum does not prove the publisher.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The tool handles passwords, tokens and keys, and a value handed to an agent enters the model context and reaches its provider
- The agent writes the reason for a request itself: the person answering must check it every time
- The published binaries are unsigned and not notarized, and the pre-1.0 version carries known limitations
This is third-party code. Review the repository files before installing.
What it does
keypaste keeps logins and project environment variables in a single KDBX 4 file that KeePassXC opens too. The vault needs no account and no network. `keypaste init` creates the file, `keypaste add` and `keypaste get` work with entries, `keypaste env pull` takes values from a `.env`, and `keypaste run dev -- npm start` starts a program with those values in its environment, leaving none on disk. The `keypaste-mcp` bridge connects the vault to an agent: your MCP client starts it, and the bridge itself holds no vault. In a separate terminal you unlock the vault and answer requests. The agent asks for one field of one entry and gives a reason, and you choose to deny, allow once or allow for an hour. Every request lands in a hash-chained log. `keypaste setup --vault ~/vault.kdbx` configures detected clients through their `mcp add` or prints a configuration block. There is a password generator for 8 to 256 characters, rotation with `keypaste rotate` that never prints the new password, change history and encrypted rolling backups next to the file.
Who it is for. For developers who let Claude Code or Codex handle deployment and APIs and do not want keys sitting in a `.env` where the agent can see them.
Good fit when
- An agent needs a key for a deployment or an API call, and you want to see which key and why it asks
- You run commands with secrets in the environment and do not want a `.env` in the project: `keypaste run` puts values only into the process
- The project has several environments: dev, staging and prod keys are set separately, and prod needs a live human answer
- You already use KeePassXC and want to keep the vault while connecting an agent to it through approval
- CI needs a token scoped like `read:acme-api/staging/*` that only injects values and expires after 30 days
Not a fit when
- You need ready team work with a shared vault: there is no merge or managed sync, and the file moves only through ordinary file sync
- You need the full KeePassXC feature set: KDBX compatibility does not mean every feature is covered
- You are on an Intel Mac, Alpine or Windows on ARM: there are no prebuilt binaries for them and installation is possible only from source
- You need a signed and notarized distribution: the published binaries are neither signed nor notarized
Example request
Deploy the billing service to staging. If you need the Stripe key, request it from keypaste and explain why you need itMCP
- Transport
- stdio
- Authentication
- not required
Environment variables
KEYPASTE_VAULT- Path to the vault file when the --vault flag is not passed
Limitations
The published CLI and MCP version is `v0.3.0`, a pre-1.0 release. The desktop app has no public release, and many features, for example share links and passphrase generation, exist only in source and are not part of the download. The author asks you to replace `v0.1.0` and `v0.2.0`: the first could delete a vault through `env export`, change the wrong entry through `env rm` and return the wrong password through `get`, and in the second a racing save could undo another program's change.
The checksum guards against a corrupted download and does not prove the publisher, because it sits at the same address as the archive. `v0.3.0` has a build attestation that GitHub CLI can check. In `v0.3.0` the `rm` command deletes an entry with its history for good. A run through `--allow-run` hands the agent output with values replaced, but a command the agent can edit may still reveal a value.
Requirements: macOS 14 or newer, Windows 10 1809 or newer, Linux on glibc 2.35. The license is AGPL-3.0.
How to disable. Run `keypaste setup --remove` to take keypaste out of the detected clients' settings, or delete the keypaste entry from your MCP settings by hand. The vault file stays on disk and KeePassXC opens it as usual.
FAQ
How do I connect keypaste to Claude Code?
Download the archive for your system, put `keypaste` and `keypaste-mcp` in `~/.local/bin` and run `keypaste setup --vault ~/vault.kdbx`. The command calls `mcp add` on the clients it finds. Then start the approval command in a terminal and answer the agent's requests.
Does the agent see my master password?
No. The client configuration contains no master password and the bridge holds no vault. The vault opens in your terminal, and the agent gets only the field you allowed.
How do I replace .env?
Create a vault with `keypaste init ~/vault.kdbx`, set `export KEYPASTE_VAULT=~/vault.kdbx`, then `keypaste env pull dev` and start programs with `keypaste run dev -- npm start`. You can delete the `.env` after import, but backups and the storage medium are not guaranteed to be erased.
Is the file compatible with KeePassXC?
Yes, it is a single KDBX 4 file and KeePassXC opens and edits the same file. The author checks compatibility in both directions with `keypassxc-cli` on Linux, macOS and Windows, but does not promise full KeePassXC feature coverage.
What makes prod a special case?
The prod profile always needs a live human answer. Other profiles can be allowed for an hour, and the source version lets you make a project automatic for a specific agent with a note in the history.
Discussion
No questions or reviews yet.
Related
MCP serversA local password manager with MCP: the agent signs in to sites, SSH and APIs while hidden secrets stay out of model context
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
A wrapper over the 1Password CLI: agents find, use and save secrets without seeing the values, and ask for approval less often
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
The official MCP exposes Bitwarden vault operations and, with separate credentials, organization administration.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| keypaste: a secrets vault that asks before an agent reads (this card) | no | not required | 839 | |
| 2password | no | 320 | a wrapper over the 1Password CLI, with no vault of its own | |
| HOL Guard | yes | 1,072 | checks agent actions, including reads of key files, but stores no secrets |
README in short
The feature section splits them into a password manager and tools for developers and agents. A terminal approval prompt and a demo recording follow. Then come install commands for three systems, download verification and a build from source.