keeper/keeper-mcp-server repository overview

⁠KSM MCP Server - Secure AI Access to Keeper Secrets

A Model Context Protocol (MCP) server that provides secure access to Keeper Secrets Manager for AI applications like Claude Desktop. Enables AI agents to safely manage secrets, passwords, and files while maintaining security controls.

⁠🚀 Quick Start

⁠Docker (Recommended)

docker run -i --rm \
  -e KSM_CONFIG_BASE64="YOUR_BASE64_CONFIG_STRING" \
  keeper/keeper-mcp-server:latest

⁠Claude Desktop Integration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "ksm": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "KSM_CONFIG_BASE64=YOUR_BASE64_CONFIG_STRING_HERE",
        "keeper/keeper-mcp-server:latest"
      ]
    }
  }
}

⁠🔧 Features

⁠Secret Operations

• list_secrets: List all accessible secrets
• get_secret: Retrieve specific secrets (with masking controls)
• search_secrets: Search by title, notes, or content
• create_secret: Create new secrets (requires confirmation)
• update_secret: Modify existing secrets (requires confirmation)
• delete_secret: Remove secrets (requires confirmation)

⁠Folder Management

• list_folders: Browse folder structure
• create_folder: Create new folders (requires confirmation)
• delete_folder: Remove folders (requires confirmation)

⁠File Operations

• upload_file: Add file attachments to secrets
• download_file: Retrieve file attachments

⁠Utilities

• generate_password: Create secure passwords
• get_totp_code: Retrieve TOTP codes
• health_check: Monitor server status

⁠🔒 Security Features

• User Confirmation: Destructive operations require explicit approval
• Data Masking: Sensitive fields masked by default
• Audit Logging: Complete operation tracking (optional)
• Silent Mode: No local file creation with --no-logs
• Encrypted Profiles: Local credential storage with encryption

⁠📋 Configuration Options

⁠Environment Variables

• KSM_CONFIG_BASE64: Your Keeper base64 configuration
• KSM_MCP_CONFIG_DIR: Custom config directory
• KSM_MCP_PROFILE: Default profile name

⁠📖 Documentation

• Docs: https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/model-context-protocol-mcp-for-ai-agents-docker⁠
• GitHub: https://github.com/Keeper-Security/keeper-mcp-golang-docker⁠
• Releases: https://github.com/Keeper-Security/keeper-mcp-golang-docker/releases⁠
• Keeper Vault: https://keepersecurity.com/vault⁠

⁠🛠️ Example Use Cases

• Securely access API keys for development
• Manage database credentials across environments
• Store and retrieve configuration files
• Generate and save strong passwords
• Automate secret rotation workflows

⁠⚡ Getting Your Config

1. Log into Keeper Vault⁠
2. Navigate to your Secrets Manager → Application → Devices tab
3. Click "Add Device" and copy the base64 configuration string
4. Use this string as your KSM_CONFIG_BASE64 value

Built with Go • Supports Linux/AMD64 & ARM64