hush · royashbrook — Claude Code MCP server: what it does, how to install
Secret store for AI agents that keeps plain text out of transcripts. Injects credentials into CLI tasks directly from the OS vault.
claude mcp add --transport http hush https://royashbrook.com/hushWhat hush does
This server prevents sensitive credentials from leaking into LLM context windows. The tool deliberately omits any retrieval command. Because the agent cannot read raw strings, secrets never land in prompts, terminal stdout, or cloud transcripts. Values stay inside native keychains: macOS Keychain, Linux libsecret, or Windows DPAPI.
A developer inputs values through a hidden prompt using hush set, or generates random keys with hush mint. The agent executes CLI tasks through hush run, which routes values directly into process environment variables. The tool can also synchronize credentials with LastPass, Bitwarden, or KeePass.
Headless environments lacking a graphical display session cannot trigger the prompt window. On automated runners, pass the secret directly through standard input.
What it helps with
- Inject credentials into CLI tasks without exposing plain text to the agent
- Persist sensitive parameters into macOS, Linux, or Windows keychains
- Generate random secret keys straight into local storage
- Synchronize stored secrets with LastPass, KeePass, or Bitwarden
Example prompts for the agent
- Store a new token under the name
stripe-keyusing the hidden prompt - Execute the deployment script with
hush runinjectingDEPLOY_TOKEN - Run
hush doctorto verify local installation and storage health
How to install hush
Platform CLI: remote server
claude mcp add --transport http hush https://royashbrook.com/hushPlatform CLI: remote server
codex mcp add hush --url https://royashbrook.com/hushConfig file
{
"mcpServers": {
"hush": {
"url": "https://royashbrook.com/hush"
}
}
}Config file
{
"servers": {
"hush": {
"type": "http",
"url": "https://royashbrook.com/hush"
}
}
}Platform CLI: remote server
gemini mcp add -t http hush https://royashbrook.com/hushStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about hush
How to install hush in Claude Code?
Run claude mcp add --transport http hush https://royashbrook.com/hush.
What does the hush MCP server do?
It keeps API keys and passwords hidden from AI models. Secrets remain in the OS keychain and pass straight into running commands without reaching transcripts.
Why does hush lack a get command?
Any read command would dump plain text into stdout. That output would immediately get sent to the model provider as part of the context.
Similar MCP servers
Everything for Security →hush by other authors comes first.
