pincer — Claude Code MCP server: proxy tokens instead of keys
An MCP gateway that hands your agent a proxy token and keeps the real API keys in an encrypted vault.
claude mcp add --env PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> --env OPENWEBUI_URL=<OPENWEBUI_URL> --env OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> --env AUDIT_LOG_PATH=<AUDIT_LOG_PATH> --transport stdio pincer -- npx -y pincer-mcpWhat pincer does
Pincer sits between the agent and outside APIs. The agent only ever holds a proxy token like pxr_...; the actual credentials live in an encrypted store at ~/.pincer/vault.db, unlocked by a master key kept in the OS keychain (macOS Keychain, Windows Credential Manager, GNOME Keyring). On each tool call Pincer swaps in the real key, runs the request, then scrubs it from memory.
The toolset covers model access: gemini_generate, openai_chat, claude_chat, openrouter_chat, openwebui_chat, matching list-models calls, and openai_compatible_chat for any OpenAI-compatible endpoint. There is also gpg_sign_data and gpg_decrypt — the PGP private key stays in the vault and never reaches the agent. Permissions are per-agent and per-tool: pincer agent authorize <agent> <tool>, optionally pinned to one stored key with --key.
You need Node.js 18+ and an OS with native keychain support. Skip pincer init or leave PINCER_PROXY_TOKEN unset and the server has nothing to work with, so set up the vault and register an agent first.
What it helps with
- give an agent API access without exposing the real keys
- route separate provider keys to separate agents
- sign artifacts with a GPG key the agent cannot read
- wire a self-hosted LLM through an OpenAI-compatible interface
- limit an agent to a specific set of tools
Example prompts for the agent
- Call
gemini_generatewith the prompt "Hello world" and modelgemini-2.0-flash - List the available OpenRouter models with
openrouter_list_models - Sign
release.tar.gzusing the vault key throughgpg_sign_data
How to install pincer
Platform CLI
claude mcp add --env PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> --env OPENWEBUI_URL=<OPENWEBUI_URL> --env OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> --env AUDIT_LOG_PATH=<AUDIT_LOG_PATH> --transport stdio pincer -- npx -y pincer-mcpReplace <…> with your own values
Platform CLI
codex mcp add pincer --env PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> --env OPENWEBUI_URL=<OPENWEBUI_URL> --env OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> --env AUDIT_LOG_PATH=<AUDIT_LOG_PATH> -- npx -y pincer-mcpReplace <…> with your own values
Config file
{
"mcpServers": {
"pincer": {
"command": "npx",
"args": [
"-y",
"pincer-mcp"
],
"env": {
"PINCER_PROXY_TOKEN": "<PINCER_PROXY_TOKEN>",
"OPENWEBUI_URL": "<OPENWEBUI_URL>",
"OPENAI_COMPATIBLE_URL": "<OPENAI_COMPATIBLE_URL>",
"AUDIT_LOG_PATH": "<AUDIT_LOG_PATH>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"pincer": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"pincer-mcp"
],
"env": {
"PINCER_PROXY_TOKEN": "<PINCER_PROXY_TOKEN>",
"OPENWEBUI_URL": "<OPENWEBUI_URL>",
"OPENAI_COMPATIBLE_URL": "<OPENAI_COMPATIBLE_URL>",
"AUDIT_LOG_PATH": "<AUDIT_LOG_PATH>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> -e OPENWEBUI_URL=<OPENWEBUI_URL> -e OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> -e AUDIT_LOG_PATH=<AUDIT_LOG_PATH> pincer npx -y pincer-mcpReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about pincer
How do I install pincer in Claude Code?
Run npm install -g pincer-mcp, then pincer init, store keys with pincer set, and create a proxy token with pincer agent add. Then register the server: claude mcp add pincer -e PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> -- npx -y pincer-mcp.
What does pincer do?
It is an MCP gateway that replaces real API keys with proxy tokens. Your agent sends a token, and Pincer pulls the actual key from its encrypted vault to make the call.
Where are the keys stored?
In ~/.pincer/vault.db, encrypted with AES-256-GCM. The master key lives in the OS keychain and never touches the filesystem.
