Blind AI to your keys — encrypted secrets vault with MCP for AI agents
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
resolve_secretResolve a secret by name using the configured backend (local vault, 1Password, Bitwarden, or env vars). Returns the decrypted value at runtime. The secret value is never visible in the LLM conversation transcript — it is resolved just-in-time for the current operation.Resolve a secret by name using the configured backend (local vault, 1Password, Bitwarden, or env vars). Returns the decrypted value at runtime. The secret value is never visible in the LLM conversation transcript — it is resolved just-in-time for the current operation.
No input schema was published for this tool.
store_secretStore a secret in the encrypted vault. The value is encrypted with AES-256-GCM before storage. The secret value is never visible in the LLM conversation transcript after this call.Store a secret in the encrypted vault. The value is encrypted with AES-256-GCM before storage. The secret value is never visible in the LLM conversation transcript after this call.
No input schema was published for this tool.
list_secretsList all stored secret names (names only — values are never revealed in this listing).List all stored secret names (names only — values are never revealed in this listing).
No input schema was published for this tool.
sandbox_envReplace real values in your .env file with deterministic fake values. Real values are encrypted and backed up to the vault. AI agents reading .env files will only see fakes. Use unsandbox_env to restore real values.Replace real values in your .env file with deterministic fake values. Real values are encrypted and backed up to the vault. AI agents reading .env files will only see fakes. Use unsandbox_env to restore real values.
No input schema was published for this tool.
unsandbox_envRestore real .env values from the vault. Reverses the sandbox operation.Restore real .env values from the vault. Reverses the sandbox operation.
No input schema was published for this tool.
delete_secretprivilegedDelete a secret from the vault.Delete a secret from the vault.
No input schema was published for this tool.
audit_logView the audit log of secret resolutions, stores, and deletes. Shows who accessed which secret and when.View the audit log of secret resolutions, stores, and deletes. Shows who accessed which secret and when.
No input schema was published for this tool.
totp_codeGenerate a TOTP 2FA code for a stored secret. Returns the current 6 or 8 digit code and seconds remaining until rotation.Generate a TOTP 2FA code for a stored secret. Returns the current 6 or 8 digit code and seconds remaining until rotation.
No input schema was published for this tool.
totp_storeStore a TOTP configuration from an otpauth:// URI (from QR code scan or manual entry).Store a TOTP configuration from an otpauth:// URI (from QR code scan or manual entry).
No input schema was published for this tool.
totp_listList all stored TOTP configurations.List all stored TOTP configurations.
No input schema was published for this tool.
totp_deleteprivilegedDelete a stored TOTP configuration.Delete a stored TOTP configuration.
No input schema was published for this tool.
create_share_linkCreate an encrypted, expiring share link for a secret. The secret is encrypted into the URL fragment and never sent to any server.Create an encrypted, expiring share link for a secret. The secret is encrypted into the URL fragment and never sent to any server.
No input schema was published for this tool.
receive_shareReceive and decrypt a shared secret from a share URL fragment.Receive and decrypt a shared secret from a share URL fragment.
No input schema was published for this tool.
deadman_statusCheck dead man's switch status — days until vault access is released to designated contacts.Check dead man's switch status — days until vault access is released to designated contacts.
No input schema was published for this tool.
deadman_checkinCheck in to reset the dead man's switch timer.Check in to reset the dead man's switch timer.
No input schema was published for this tool.
team_initCreate a new shared team vault (encrypted SQLite). Requires a passphrase.Create a new shared team vault (encrypted SQLite). Requires a passphrase.
No input schema was published for this tool.
team_pushPush a local secret to the shared team vault.Push a local secret to the shared team vault.
No input schema was published for this tool.
team_pullImport all secrets from the team vault into your local vault.Import all secrets from the team vault into your local vault.
No input schema was published for this tool.
team_listList all secret names in the team vault.List all secret names in the team vault.
No input schema was published for this tool.
team_resolveResolve (decrypt) a single secret from the team vault.Resolve (decrypt) a single secret from the team vault.
No input schema was published for this tool.
team_deleteprivilegedDelete a secret from the team vault.Delete a secret from the team vault.
No input schema was published for this tool.
sso_statusCheck SSO/OIDC authentication status for team vault access.Check SSO/OIDC authentication status for team vault access.
No input schema was published for this tool.
register_agentRegister an AI agent in the Know Your Agent registry, bound to a human sponsor. Returns the agent identity and its Ed25519 private key, which the agent holds to sign its own actions.Register an AI agent in the Know Your Agent registry, bound to a human sponsor. Returns the agent identity and its Ed25519 private key, which the agent holds to sign its own actions.
No input schema was published for this tool.
record_actionAppend a signed action to the tamper-proof agent ledger. Each entry is hash-chained and Ed25519-signed, so any later edit or reorder is detectable.Append a signed action to the tamper-proof agent ledger. Each entry is hash-chained and Ed25519-signed, so any later edit or reorder is detectable.
No input schema was published for this tool.
verify_ledgerVerify the integrity of the agent action ledger by re-walking the hash chain and signatures. Returns the first sequence that fails if the ledger was tampered with.Verify the integrity of the agent action ledger by re-walking the hash chain and signatures. Returns the first sequence that fails if the ledger was tampered with.
No input schema was published for this tool.
list_agentsList all agents in the Know Your Agent registry.List all agents in the Know Your Agent registry.
No input schema was published for this tool.
export_complianceExport the agent action ledger as a compliance report (JSON or CSV) with human-sponsor attribution.Export the agent action ledger as a compliance report (JSON or CSV) with human-sponsor attribution.
No input schema was published for this tool.
27 of 27 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Blind AI to your keys — encrypted secrets vault with MCP for AI agents
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
76 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+64 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.