hush · omarei-omoto — Claude Code MCP server: team secrets the agent can't read
Keeps team keys encrypted inside the repo. Your agent can use a secret without ever seeing its value.
claude mcp add hush -- npx -y @omarei/hushWhat hush does
A .env file sits in plaintext and every process you start can open it. hush moves those values into .hush/vault.json, an encrypted set you can commit. Running hush npm run dev injects them into that one process — they never land on disk or in your shell history.
The agent gets tools that apply a key without revealing it. hush team add sam hush_pk_1xM… grants a teammate access; hush team rm sam re-keys the vault and re-seals every value. Two scans cover cleanup: hush scan --agents finds plaintext keys in agent config files and with --fix moves them into the vault, while hush scan --transcripts looks through saved conversations in read-only mode.
It is early software. Pre-1.0, one author, and no external security review yet. The crypto follows age's construction rebuilt on node:crypto, backed by a differential test suite against an independent reimplementation — useful, though not the same as a qualified audit. Development runs on macOS, Linux is handled in CI, and Windows is in beta: the key is kept with DPAPI, approvals use a native dialog, and fingerprint approval via Windows Hello is not there yet.
What it helps with
- get plaintext keys out of the repo's
.env - let an agent use a secret without exposing it
- grant a teammate access in one command and revoke it
- find keys left behind in agent config files
- check whether keys leaked into saved conversations
Example prompts for the agent
- Set up hush in this project: run
hush setup --jsonand follow each step. - Add the secrets from
.envas a set called dev, then delete the file. - Run
hush scan --agentsand move anything it finds into the vault.
How to install hush
Platform CLI
claude mcp add hush -- npx -y @omarei/hushPlatform CLI
codex mcp add omarei-omoto-hush -- npx -y @omarei/hushConfig file
{
"mcpServers": {
"omarei-omoto-hush": {
"command": "npx",
"args": [
"-y",
"@omarei/hush"
]
}
}
}Config file
{
"servers": {
"omarei-omoto-hush": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@omarei/hush"
]
}
}
}Platform CLI
gemini mcp add omarei-omoto-hush npx -y @omarei/hushStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about hush
How do I install hush in Claude Code?
Add the server with claude mcp add hush -- npx -y @omarei/hush.
What does hush do?
It keeps team secrets encrypted inside the repository and gives your agent tools that use a key without reading it.
How is hush different from a plain .env?
Values are not stored as plaintext: they are encrypted in .hush/vault.json and only reach a process when you launch it through hush.
Similar MCP servers
Everything for Security →hush by other authors comes first.
