# kdbx

kdbx gives an agent read access to secrets in a local KeePassXC vault and runs commands with environment variables injected. Secret values stay out of shell history.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: yarrasys
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/yarrasys/kdbx
- Updated: 2026-10-22
- HTML: https://affpapa.org/en/nevibecode/mcp/kdbx

## What it does

kdbx connects a project to a KeePassXC vault through a `.keepassxc.json` file in the repository. The file defines environments and maps environment variables to vault entries. The secrets themselves stay outside the repository.

The `kdbx run -- <cmd>` command passes the mapped values to a child process alongside its existing environment. The MCP server gives the agent read-only access to secrets. You need a KeePassXC vault and its key file; if that key file is lost, the vault cannot be recovered, so keep a backup.

## Requirements
- Needs: Docker
- Environment variables: `KEEPASSXC_DIR`, `KDBX_ENV` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env KEEPASSXC_DIR=<KEEPASSXC_DIR> --env KDBX_ENV=<KDBX_ENV> --transport stdio kdbx -- docker run -i --rm -e KEEPASSXC_DIR -e KDBX_ENV ghcr.io/yarrasys/kdbx:0.3.2
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add kdbx --env KEEPASSXC_DIR=<KEEPASSXC_DIR> --env KDBX_ENV=<KDBX_ENV> -- docker run -i --rm -e KEEPASSXC_DIR -e KDBX_ENV ghcr.io/yarrasys/kdbx:0.3.2
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "kdbx": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "KEEPASSXC_DIR",
                "-e",
                "KDBX_ENV",
                "ghcr.io/yarrasys/kdbx:0.3.2"
            ],
            "env": {
                "KEEPASSXC_DIR": "<KEEPASSXC_DIR>",
                "KDBX_ENV": "<KDBX_ENV>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "kdbx": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "-e",
                "KEEPASSXC_DIR",
                "-e",
                "KDBX_ENV",
                "ghcr.io/yarrasys/kdbx:0.3.2"
            ],
            "env": {
                "KEEPASSXC_DIR": "<KEEPASSXC_DIR>",
                "KDBX_ENV": "<KDBX_ENV>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e KEEPASSXC_DIR=<KEEPASSXC_DIR> -e KDBX_ENV=<KDBX_ENV> kdbx docker run -i --rm -e KEEPASSXC_DIR -e KDBX_ENV ghcr.io/yarrasys/kdbx:0.3.2
```
Replace <…> with your own values

## When to use it
- pass secrets to a process without an `.env` file
- run tests with variables from a KeePassXC vault
- separate project secrets by environment
- give an agent read access to project secrets

## Example prompts
- Run the project tests with secrets from the active kdbx environment.
- Read the vault entry mapped to `OPENAI_API_KEY` without displaying its value.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [GitHub](https://affpapa.org/en/nevibecode/mcp/github.md) — MCP server · ★ 33989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [Netdata](https://affpapa.org/en/nevibecode/mcp/netdata.md) — MCP server · ★ 81163
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Scrapling MCP Server](https://affpapa.org/en/nevibecode/mcp/scrapling-mcp-server.md) — MCP server · ★ 89899

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md