# hush

Secret store for AI agents that keeps plain text out of transcripts. Injects credentials into CLI tasks directly from the OS vault.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 20
- Author: royashbrook
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/royashbrook/hush
- Updated: 2026-09-24
- HTML: https://affpapa.org/en/nevibecode/mcp/hush

## What it does

This server prevents sensitive credentials from leaking into LLM context windows. The tool deliberately omits any retrieval command. Because the agent cannot read raw strings, secrets never land in prompts, terminal stdout, or cloud transcripts. Values stay inside native keychains: macOS Keychain, Linux libsecret, or Windows DPAPI.

A developer inputs values through a hidden prompt using `hush set`, or generates random keys with `hush mint`. The agent executes CLI tasks through `hush run`, which routes values directly into process environment variables. The tool can also synchronize credentials with LastPass, Bitwarden, or KeePass.

Headless environments lacking a graphical display session cannot trigger the prompt window. On automated runners, pass the secret directly through standard input.

## Requirements
- Remote server: `https://royashbrook.com/hush`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http hush https://royashbrook.com/hush
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add hush --url https://royashbrook.com/hush
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hush": {
            "url": "https://royashbrook.com/hush"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hush": {
            "type": "http",
            "url": "https://royashbrook.com/hush"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http hush https://royashbrook.com/hush
```

## When to use it
- Inject credentials into CLI tasks without exposing plain text to the agent
- Persist sensitive parameters into macOS, Linux, or Windows keychains
- Generate random secret keys straight into local storage
- Synchronize stored secrets with LastPass, KeePass, or Bitwarden

## Example prompts
- Store a new token under the name `stripe-key` using the hidden prompt
- Execute the deployment script with `hush run` injecting `DEPLOY_TOKEN`
- Run `hush doctor` to verify local installation and storage health

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

## Other versions with the same name
- [hush · omarei-omoto](https://affpapa.org/en/nevibecode/mcp/omarei-omoto-hush.md) — ★ 6

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md