# enigmagent-mcp

A local encrypted vault for API keys. Your agent reads entry names, not the values themselves.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: Agnuxo1
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Agnuxo1/enigmagent-mcp
- Updated: 2026-09-21
- HTML: https://affpapa.org/en/nevibecode/mcp/enigmagent-mcp

## What it does

\`enigmagent-mcp` keeps secret values in a vault file encrypted with AES-256-GCM, using a key derived through Argon2id. The file stays encrypted on disk, so it will not leak through a repo or a log. Version 2.0.0 still reads version 1 vaults and writes new ones in format version 2.

MCP starts in metadata-only mode. The `enigmagent_list` tool returns names, domains and creation timestamps. The tool that hands back an actual value, `enigmagent_resolve`, stays off until the operator passes `--allow-raw-resolve` or sets `ENIGMAGENT_ALLOW_RAW_RESOLVE=1`. The author is blunt about this switch: leave it off for an untrusted client or a shared process, since a trusted client can still forward the plaintext it receives to its model.

A REST mode exists too. It binds to `127.0.0.1` only, wants a Bearer token of 32 to 256 characters, and turns away browser-origin requests. `GET /health` answers without auth; everything else needs the token. On a first run attached to a terminal the server asks for the vault credentials, and a headless process should carry `ENIGMAGENT_USER` and `ENIGMAGENT_PASS` in its own environment. Vault writes go through a temporary file with a recovery backup, so an interrupted write will not leave you with a broken vault.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `VAULT_PASSWORD`, `VAULT_PATH` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env VAULT_PASSWORD=<VAULT_PASSWORD> --env VAULT_PATH=<VAULT_PATH> --transport stdio enigmagent-mcp -- npx -y enigmagent-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add enigmagent-mcp --env VAULT_PASSWORD=<VAULT_PASSWORD> --env VAULT_PATH=<VAULT_PATH> -- npx -y enigmagent-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "enigmagent-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "enigmagent-mcp"
            ],
            "env": {
                "VAULT_PASSWORD": "<VAULT_PASSWORD>",
                "VAULT_PATH": "<VAULT_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "enigmagent-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "enigmagent-mcp"
            ],
            "env": {
                "VAULT_PASSWORD": "<VAULT_PASSWORD>",
                "VAULT_PATH": "<VAULT_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e VAULT_PASSWORD=<VAULT_PASSWORD> -e VAULT_PATH=<VAULT_PATH> enigmagent-mcp npx -y enigmagent-mcp
```
Replace <…> with your own values

## When to use it
- keep API keys out of the model context
- expose secret names to an agent without the values
- encrypt a vault on disk behind a password
- run a local token-protected REST endpoint over secrets
- carry a version 1 vault over to format version 2

## Example prompts
- List my secrets with `enigmagent_list`
- Resolve the value bound to api.example.com via `enigmagent_resolve`
- Start the server in REST mode on port 3737 with the vault `./my.vault.json`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md