# hush

Keeps team keys encrypted inside the repo. Your agent can use a secret without ever seeing its value.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: omarei-omoto
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/omarei-omoto/hush
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/omarei-omoto-hush

## What it does

A `.env` file sits in plaintext and every process you start can open it. hush moves those values into `.hush/vault.json`, an encrypted set you can commit. Running `hush npm run dev` injects them into that one process — they never land on disk or in your shell history.

The agent gets tools that apply a key without revealing it. `hush team add sam hush_pk_1xM…` grants a teammate access; `hush team rm sam` re-keys the vault and re-seals every value. Two scans cover cleanup: `hush scan --agents` finds plaintext keys in agent config files and with `--fix` moves them into the vault, while `hush scan --transcripts` looks through saved conversations in read-only mode.

It is early software. Pre-1.0, one author, and no external security review yet. The crypto follows age's construction rebuilt on `node:crypto`, backed by a differential test suite against an independent reimplementation — useful, though not the same as a qualified audit. Development runs on macOS, Linux is handled in CI, and Windows is in beta: the key is kept with DPAPI, approvals use a native dialog, and fingerprint approval via Windows Hello is not there yet.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add hush -- npx -y @omarei/hush
```

### Codex

**Platform CLI**
```bash
codex mcp add omarei-omoto-hush -- npx -y @omarei/hush
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "omarei-omoto-hush": {
            "command": "npx",
            "args": [
                "-y",
                "@omarei/hush"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "omarei-omoto-hush": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@omarei/hush"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add omarei-omoto-hush npx -y @omarei/hush
```

## When to use it
- get plaintext keys out of the repo's `.env`
- let an agent use a secret without exposing it
- grant a teammate access in one command and revoke it
- find keys left behind in agent config files
- check whether keys leaked into saved conversations

## Example prompts
- Set up hush in this project: run `hush setup --json` and follow each step.
- Add the secrets from `.env` as a set called dev, then delete the file.
- Run `hush scan --agents` and move anything it finds into the vault.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

## Other versions with the same name
- [hush · royashbrook](https://affpapa.org/en/nevibecode/mcp/hush.md) — ★ 20

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md