Stars

—

Tools

—

Uptime

—

Developers regularly leak API keys, passwords, and tokens to AI coding tools. 100,000+ LLM conversations with exposed secrets were found indexed by search engines in 2025.

AI agents read your .env files. They copy-paste secrets into conversations. They commit them accidentally. Keyblind stops this by keeping secrets encrypted at rest and resolving them at runtime — the plaintext value never touches the LLM transcript.

How It Works

┌──────────┐     ┌────────────────┐     ┌─────────────────┐
│ AI Agent │ ──→ │  Keyblind MCP  │ ──→ │  Encrypted      │
│ (Claude) │     │  Server        │     │  SQLite Vault   │
│          │ ←── │  (16 tools)    │ ←── │  (AES-256-GCM)  │
└──────────┘     └────────────────┘     └─────────────────┘
      ↑                                        │
      │ secret value never appears             │ secrets never
      │ in conversation transcript             │ stored in plaintext

Quick Start

# 1. Install
npm i -g keyblind

# 2. Initialize your vault
keyblind init

# 3. Auto-configure MCP for Claude Code (one command)
keyblind setup-mcp

# 4. Store secrets
echo "sk-proj-abc123" | keyblind set OPENAI_API_KEY
keyblind set DATABASE_URL -    # prompts securely

# 5. Sandbox your .env (AI agents see fakes)
keyblind sandbox

# 6. Resolve a secret
keyblind get OPENAI_API_KEY

# 7. Run commands with secrets injected as env vars
keyblind run -- npm start

# 8. List all secrets (names only, values hidden)
keyblind list

That's it. After keyblind setup-mcp, restart Claude Code. Then just say "list my keyblind secrets" or "use my OPENAI_API_KEY" — the AI agent resolves secrets at runtime without ever seeing them in the transcript.

MCP Server

Keyblind is MCP-first — it works with every AI tool that speaks the Model Context Protocol (Claude Code, Cursor, Copilot, Windsurf, Cline, Zed).

Setup (automatic)

keyblind setup-mcp

This auto-configures Claude Code to use Keyblind. Works from any directory. For other editors, see editor-specific configs.

Setup (manual)

Add a .mcp.json to your project root, or use claude mcp add:

claude mcp add --scope user keyblind -- keyblind start

With biometric gate (Touch ID required before secrets are resolved):

keyblind unlock                      # Authenticate first
claude mcp add keyblind -- keyblind start --biometric

Session expires after 15 minutes. Requires Pro or Team license.

MCP Tools

Web Dashboard

Manage your secrets from a browser — no sign-in or pairing required. Open the local dashboard:

keyblind dashboard

This starts the local server and opens http://localhost:4318/ in your browser. The dashboard is served same-origin with the REST API, so it works in every browser with no CORS, no pairing token, and no login. Features:

• View, add, copy, and delete secrets
• Audit log with full access history
• License management (tier, email, expiry)
• Pro/Team tier status
• Per-secret access policies and rotation reminders

Browser Extension

The Keyblind Chrome Extension detects and blocks secrets from being pasted into AI chat interfaces (Claude.ai, ChatGPT, Copilot).

Features:

• Detects 12+ API key formats (OpenAI, GitHub, Stripe, AWS, etc.)
• Intercepts paste events on AI chat sites
• Warning banner when secrets are detected
• Popup with vault connection status

Located in browser-extension/. Load as unpacked extension from chrome://extensions.

Pricing

# Buy a license at keyblind.dev, then activate:
keyblind activate <your-license-key>

# Check your status
keyblind status

Backends

Keyblind supports multiple secret backends:

keyblind backends                          # List available backends
keyblind backend 1password                 # Switch to 1Password
keyblind backend bitwarden                 # Switch to Bitwarden

Keyblind vs Cloak

Security

• AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
• Machine-identity-bound key — encryption key XOR-wrapped with machine fingerprint
• Zero network, zero telemetry — no cloud, no accounts, no analytics
• Vault stored at ~/.keyblind/ with 0700 permissions
• Deterministic sandbox fakes using HMAC-SHA256 per project + key name

CLI Reference

keyblind init                 Initialize the encrypted vault
keyblind set <name>           Store a secret (value from stdin)
keyblind set <name> -         Store a secret (prompts securely)
keyblind get <name>           Resolve and print a secret
keyblind list                 List all stored secrets
keyblind delete <name>        Delete a secret
keyblind setup-mcp            Auto-configure MCP for Claude Code
keyblind sandbox [.env]       Replace .env with deterministic fakes
keyblind unsandbox [.env]     Restore real .env values
keyblind run <command...>     Run command with secrets as env vars
keyblind start                Start MCP server (stdio — for AI agents)
keyblind start --http         Start HTTP server (dashboard + MCP + REST API)
keyblind dashboard            Open the web dashboard in your browser
keyblind start --biometric    Start MCP server with biometric requirement
keyblind backends             List available backends
keyblind backend <name>       Switch backend
keyblind activate <key>       Activate a Pro/Team license
keyblind deactivate           Remove current license
keyblind status               Show license and vault status
keyblind audit                Show secret resolution audit log
keyblind check --expired      List secrets past expiry
keyblind rotate <name>        Update a secret value
keyblind rotate <name> --generate  Rotate with an auto-generated value
keyblind rotate --overdue [days]    Rotate all secrets past the threshold
keyblind rotate-needed [days] List secrets not rotated in N days (default 90)
keyblind policy set <secret> <policy>  Restrict which agents may access a secret
keyblind policy list          List per-secret policies
keyblind scan-repo [--all]    Scan tracked files (or full history) for secrets
keyblind setup-ci             Write a GitHub Actions secret-scan workflow
keyblind ci export            Export an encrypted bundle for CI injection (Pro)
keyblind ci inject            Decrypt a bundle and write secrets to $GITHUB_ENV
keyblind ci setup             Write a GitHub Actions workflow for CI injection
keyblind team init [path]     Create a shared team vault
keyblind team push <name>     Push a secret to team vault
keyblind team pull            Pull secrets from team vault
keyblind team list            List secrets in team vault
keyblind totp set <name>      Store TOTP 2FA config
keyblind totp code <name>     Generate current TOTP code
keyblind totp list            List all TOTP configs
keyblind totp delete <name>   Delete a TOTP config
keyblind share <name>         Create encrypted share link
keyblind receive <url>        Receive a shared secret
keyblind deadman setup        Configure dead man's switch
keyblind deadman checkin      Reset dead man's switch timer
keyblind deadman status       Show dead man's switch status
keyblind deadman disable      Disable dead man's switch
keyblind sso configure        Set up SSO/OIDC for team access
keyblind sso login            Authenticate via browser SSO
keyblind sso logout           Clear SSO session
keyblind sso status           Show SSO auth status
keyblind doctor               Run vault health check
keyblind generate <name>      Generate a strong random secret
keyblind import [.env]        Bulk import from .env file
keyblind export               Export all secrets
keyblind completions [shell]  Generate shell completion script

Development

git clone https://github.com/aarifmms/keyblind.git
cd keyblind
npm install
npm run build       # Compile TypeScript
npm test            # Run tests
npm run dev         # Watch mode

License

MIT

© 2026 MCP Directory.