Phantom Secrets — Claude Code MCP server: features and setup
This MCP server lets an agent inspect secret metadata without seeing secret values. Use it when project credentials need to reach an app through a local proxy.
claude mcp add phantom-secrets-mcp -- npx -y phantom-secrets-mcpWhat Phantom Secrets does
Phantom swaps project secrets in dotenv files for scoped phm_ markers. Applications send those markers through an authenticated local proxy; the agent gets MCP tools for inventory and diagnostics without access to key values. Governed requests are supported too.
The project includes a CLI, a vault, and a local proxy. Add the server to Claude Code with the commands in the FAQ. One important boundary: in version 0.7.9, provider-key issuance and renewal are blocked before any credential or network access. Workflows that depend on those operations cannot use them.
What it helps with
- keep key values out of agent context
- replace project dotenv secrets with
phm_markers - inspect secret metadata through MCP
- route an app's credential request through a local proxy
Example prompts for the agent
- Show the project's secret inventory without revealing key values.
- Check Phantom's status and diagnose the project's secrets.
- Prepare a governed request involving a project secret.
How to install Phantom Secrets
Platform CLI
claude mcp add phantom-secrets-mcp -- npx -y phantom-secrets-mcpPlatform CLI
codex mcp add phantom-mcp -- npx -y phantom-secrets-mcpConfig file
{
"mcpServers": {
"phantom-mcp": {
"command": "npx",
"args": [
"-y",
"phantom-secrets-mcp"
]
}
}
}Config file
{
"servers": {
"phantom-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"phantom-secrets-mcp"
]
}
}
}Platform CLI
gemini mcp add phantom-mcp npx -y phantom-secrets-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Phantom Secrets
How do I install Phantom Secrets in Claude Code?
Run both commands in this order: claude mcp add phantom-secrets-mcp -- npx -y phantom-secrets-mcp, then claude mcp add phantom-mcp -- npx -y phantom-secrets-mcp.
What does Phantom Secrets do?
It replaces project secrets with phm_ markers that applications use through a local proxy. Its MCP tools let an agent inspect inventory and run diagnostics without exposing key values.
Can Phantom Secrets issue provider keys?
In version 0.7.9, provider-key issuance and renewal paths are blocked before credentials or network access are reached.
