OpenKeylet MCP
A local password manager with MCP: the agent signs in to sites, SSH and APIs while hidden secrets stay out of model context
- 134 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The agent can sign in on your behalf, run SSH commands and send requests with your tokens, and there is no sandbox protection.
- Visibility can be switched on for individual fields, and the value then enters the model context.
Install
- Works in
Manual install
{"mcpServers":{"openkeylet":{"command":"/absolute/path/to/openkeylet","args":["mcp","stdio"]}}}Manual setup: give the absolute path to the executable. `openkeylet config stdio-json` prints a ready fragment.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent can sign in on your behalf, run SSH commands and send requests with your tokens, and there is no sandbox protection.
- Visibility can be switched on for individual fields, and the value then enters the model context.
This is third-party code. Review the repository files before installing.
What it does
OpenKeylet keeps logins, API keys, SSH keys, TOTP codes and bank cards in an encrypted vault on your computer and lets an agent act with them. The agent sees record names, field names and available actions, while OpenKeylet itself inserts the secret without returning it in an MCP response. Each field has its own switch: hidden (the default), visible to the agent, or TOTP, where only the current six-digit code leaves the vault. A record carries actions: fill a focused field in a browser or window, run a command over SSH, upload or download files over SFTP, send an authenticated HTTP request and run a local command with hidden fields substituted. The server exposes `items_search`, `credential_fill`, `ssh_run`, `ssh_upload`, `ssh_download`, `http_send` and the `terminal_*` family for this. There is no tool that hands out a password directly. A Chromium extension ships in the box: it fills passwords, cards and identities, supports passkeys and offers to save a new login. Backups are encrypted, and a snapshot can optionally go into your private GitHub repository. Bitwarden data and passwords from Chrome and Edge can be imported.
Who it is for. Developers and administrators whose agents reach servers and private APIs and who do not want to paste passwords into a chat.
Good fit when
- A build is deployed to a production server over SSH, and the key must not enter the dialogue text.
- A list of domains from a DNS panel is requested over the API with a token from the "DNS Provider" record.
- Signing in to a site admin console works by filling the login and password in the focused fields.
- Sign-in requires a one-time code, and OpenKeylet supplies the current TOTP code without revealing the seed.
- An agent uploads a build directory to a server and downloads logs over SFTP.
Not a fit when
- You need a password manager with cloud sync and team sharing: the vault is local, and backup works through snapshots.
- The agent must not be allowed to run SSH and HTTP commands on your behalf.
- Other processes run under your user on the computer: OpenKeylet is not a sandbox and does not protect against them.
- The environment is Linux with Wayland and desktop window input is needed: input is supported on X11.
Example request
Use "Production Server" in OpenKeylet MCP to deploy the current build over SSH and verify that the service responds.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
It is not a sandbox: OpenKeylet does not guard against a malicious agent, a compromised computer or another process of the same user, and it does not check whether the right field has focus. For the duration of an action the secret sits in the memory of OpenKeylet and the target program. Builds exist for Windows x64, macOS arm64 and Linux x64; on macOS typing into windows needs the Accessibility permission, and on Linux typing works under X11. The recovery key of a GitHub backup must not be lost, or the copy cannot be opened. Git history also keeps deleted credentials in encrypted form.
How to disable. Open Settings, Agent connection and disconnect the agent, or delete the `openkeylet` entry from the client configuration. The vault lives in the user data folder (`mcp-vault/v2`) and is deleted separately after exporting a backup.
FAQ
How do I connect OpenKeylet to Claude Code?
Download a build from the releases, open Settings, Agent connection, choose Claude Code and start a new agent session. By hand, add the `openkeylet` command with the arguments `mcp` and `stdio` to the client configuration; `openkeylet config stdio-json` prints a ready fragment.
Does the model see my passwords?
Not by default. OpenKeylet uses hidden fields locally and leaves them out of MCP responses. A password returns to the agent only after you manually switch on visibility for that field.
Which credentials can be stored?
Logins and passwords, API keys and tokens, SSH private keys with passphrases, TOTP seeds, hosts, ports, service URLs and custom fields. Modules in one record combine freely.
Is an OpenKeylet account required?
No, no account or subscription is needed, and the vault lives on your computer. The GitHub backup works through your own account and private repository.
How do I move data from Bitwarden?
Open System, Local data, Import vault and choose an unencrypted Bitwarden JSON or a Chrome or Edge password CSV. A preview shows the record count and differences before the import, and cancelling changes nothing.
Discussion
No questions or reviews yet.
Related
MCP serversA CLI and MCP bridge over a KeePass-compatible vault: an agent gets one secret only after your answer, and every request lands in a log
The official MCP exposes Bitwarden vault operations and, with separate credentials, organization administration.
A Mac key vault for agents: Sallyport runs HTTP and SSH with your keys over MCP, and the agent never receives the key itself
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A wrapper over the 1Password CLI: agents find, use and save secrets without seeing the values, and ask for approval less often
README in short
The document walks through sample requests, record actions and field visibility, then explains how the browser extension, SSH and API behave. It continues with the vault location, backup encryption, the security model and build-from-source steps for Rust and Tauri.