# Phantom Secrets

This MCP server lets an agent inspect secret metadata without seeing secret values. Use it when project credentials need to reach an app through a local proxy.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 18
- Author: ashlrai
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/ashlrai/phantom-secrets/tree/HEAD/crates/phantom-mcp
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/phantom-secrets

## What it does

Phantom swaps project secrets in dotenv files for scoped `phm_` markers. Applications send those markers through an authenticated local proxy; the agent gets MCP tools for inventory and diagnostics without access to key values. Governed requests are supported too.

The project includes a CLI, a vault, and a local proxy. Add the server to Claude Code with the commands in the FAQ. One important boundary: in version 0.7.9, provider-key issuance and renewal are blocked before any credential or network access. Workflows that depend on those operations cannot use them.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add phantom-secrets-mcp -- npx -y phantom-secrets-mcp
```

### Codex

**Platform CLI**
```bash
codex mcp add phantom-mcp -- npx -y phantom-secrets-mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "phantom-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "phantom-secrets-mcp"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "phantom-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "phantom-secrets-mcp"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add phantom-mcp npx -y phantom-secrets-mcp
```

## When to use it
- keep key values out of agent context
- replace project dotenv secrets with `phm_` markers
- inspect secret metadata through MCP
- route an app's credential request through a local proxy

## Example prompts
- Show the project's secret inventory without revealing key values.
- Check Phantom's status and diagnose the project's secrets.
- Prepare a governed request involving a project secret.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md