# pincer

An MCP gateway that hands your agent a proxy token and keeps the real API keys in an encrypted vault.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: VouchlyAI
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/VouchlyAI/Pincer-MCP
- Updated: 2026-02-18
- HTML: https://affpapa.org/en/nevibecode/mcp/pincer

## What it does

Pincer sits between the agent and outside APIs. The agent only ever holds a proxy token like `pxr_...`; the actual credentials live in an encrypted store at `~/.pincer/vault.db`, unlocked by a master key kept in the OS keychain (macOS Keychain, Windows Credential Manager, GNOME Keyring). On each tool call Pincer swaps in the real key, runs the request, then scrubs it from memory.

The toolset covers model access: `gemini_generate`, `openai_chat`, `claude_chat`, `openrouter_chat`, `openwebui_chat`, matching list-models calls, and `openai_compatible_chat` for any OpenAI-compatible endpoint. There is also `gpg_sign_data` and `gpg_decrypt` — the PGP private key stays in the vault and never reaches the agent. Permissions are per-agent and per-tool: `pincer agent authorize <agent> <tool>`, optionally pinned to one stored key with `--key`.

You need Node.js 18+ and an OS with native keychain support. Skip `pincer init` or leave `PINCER_PROXY_TOKEN` unset and the server has nothing to work with, so set up the vault and register an agent first.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `PINCER_PROXY_TOKEN`, `OPENWEBUI_URL`, `OPENAI_COMPATIBLE_URL`, `AUDIT_LOG_PATH` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> --env OPENWEBUI_URL=<OPENWEBUI_URL> --env OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> --env AUDIT_LOG_PATH=<AUDIT_LOG_PATH> --transport stdio pincer -- npx -y pincer-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add pincer --env PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> --env OPENWEBUI_URL=<OPENWEBUI_URL> --env OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> --env AUDIT_LOG_PATH=<AUDIT_LOG_PATH> -- npx -y pincer-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "pincer": {
            "command": "npx",
            "args": [
                "-y",
                "pincer-mcp"
            ],
            "env": {
                "PINCER_PROXY_TOKEN": "<PINCER_PROXY_TOKEN>",
                "OPENWEBUI_URL": "<OPENWEBUI_URL>",
                "OPENAI_COMPATIBLE_URL": "<OPENAI_COMPATIBLE_URL>",
                "AUDIT_LOG_PATH": "<AUDIT_LOG_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "pincer": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "pincer-mcp"
            ],
            "env": {
                "PINCER_PROXY_TOKEN": "<PINCER_PROXY_TOKEN>",
                "OPENWEBUI_URL": "<OPENWEBUI_URL>",
                "OPENAI_COMPATIBLE_URL": "<OPENAI_COMPATIBLE_URL>",
                "AUDIT_LOG_PATH": "<AUDIT_LOG_PATH>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e PINCER_PROXY_TOKEN=<PINCER_PROXY_TOKEN> -e OPENWEBUI_URL=<OPENWEBUI_URL> -e OPENAI_COMPATIBLE_URL=<OPENAI_COMPATIBLE_URL> -e AUDIT_LOG_PATH=<AUDIT_LOG_PATH> pincer npx -y pincer-mcp
```
Replace <…> with your own values

## When to use it
- give an agent API access without exposing the real keys
- route separate provider keys to separate agents
- sign artifacts with a GPG key the agent cannot read
- wire a self-hosted LLM through an OpenAI-compatible interface
- limit an agent to a specific set of tools

## Example prompts
- Call `gemini_generate` with the prompt "Hello world" and model `gemini-2.0-flash`
- List the available OpenRouter models with `openrouter_list_models`
- Sign `release.tar.gz` using the vault key through `gpg_sign_data`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md