AI Agents

Integrate Keeper Secrets Manager and Commander with AI coding agents like Claude Code, Cursor, Codex, and GitHub Copilot.

Use AI coding agents with Keeper to retrieve secrets, manage vaults, and run admin workflows from the terminal. Credentials stay out of chat and source control.

GitHub: github.com/Keeper-Security/keeper-agent-kit

---

Overview

Keeper supports two integration models for AI agents: skills/plugins for CLI-driven developer workflows, and MCP servers for agent orchestration platforms. This page covers the Keeper Agent Kit, a set of skills (also called plugins) that teach AI coding agents how to use Keeper's CLI tools.

After installation, your agent can:

• Retrieve and inject secrets with ksm (Keeper Secrets Manager CLI)

• Manage vaults, users, teams, and PAM resources with keeper (Commander CLI)

• Set up both CLIs from scratch if they aren't installed yet

Credentials never appear in chat or get committed to source control. The KSM CLI and Commander CLI resolve secrets at runtime. All access is subject to the same RBAC policies and audit logging as any other Keeper integration.

For the MCP-based approach see MCP for AI Agents (Docker).

---

What's Included

The Agent Kit contains three skills:

Skill	What it does	CLI used
keeper-secrets	App secrets, ksm exec, templates, CI/CD injection	ksm
keeper-admin	Users, teams, PAM, enterprise vault operations	keeper
keeper-setup	Install CLIs, configure profiles, first-time setup	Both

---

Prerequisites

You'll need:

• A Keeper Security account (Business or Enterprise)

• Python 3.10 or later

• macOS, Linux, or Windows

The KSM CLI and Commander CLI can be installed manually, or you can let the keeper-setup skill walk your agent through first-time setup.

CLI	Install Docs
KSM CLI	Secrets Manager CLI
Commander CLI	Commander Installation

---

Installation

Choose the guide that matches your setup:

Method	Best for	Guide
Claude Plugin Marketplace	Claude users	Install with Claude
Skills CLI (npx skills)	Cursor, Codex, Copilot, and multi-agent setups	Install with Skills CLI
Manual (git clone)	Air-gapped environments, custom agent setups	Install Manually

All three methods install the same skills. Pick whichever fits your workflow.

---

Supported Agents

Agent	Plugin Marketplace	Skills CLI	Manual
Claude Code	✅	✅	✅
Cursor	✅	✅	✅
Codex	—	✅	✅
GitHub Copilot	—	✅	✅
VS Code (Copilot Chat)	—	✅	✅
Other agents	—	✅ (auto-detect)	✅

---

Quick Start

After installing, use your agent as usual. Skills activate based on context.

Inject a secret into your environment:

"Help me inject my database credentials from Keeper into my app's .env file"

The agent uses keeper-secrets to run ksm exec and pull the secret in without showing it in chat.

Set up KSM for the first time:

"I need to configure Keeper Secrets Manager on this machine"

The agent uses keeper-setup to walk you through CLI installation, profile creation, and token setup.

Look up a user in your Keeper enterprise:

"List all users on the Engineering team in Keeper"

The agent uses keeper-admin to run the right Commander command.

For more examples, see our sample Test Prompts in the repo.

---

How It Works

Skills are markdown files (SKILL.md) that tell your AI agent how to use a CLI tool. They're not executable code. Each skill documents commands, flags, and error-handling patterns. When you ask a question, the agent reads the relevant skill and builds the right CLI commands from it.

keeper-agent-kit/
├── plugins/
│   ├── keeper-secrets/    # KSM CLI skill
│   │   └── skills/keeper-secrets/SKILL.md
│   ├── keeper-admin/      # Commander CLI skill
│   │   └── skills/keeper-admin/SKILL.md
│   └── keeper-setup/      # Setup & install skill
│       └── skills/keeper-setup/SKILL.md

Security model: The agent runs CLI commands on your local machine using your authenticated session. Secrets are resolved by the KSM and Commander CLIs at runtime, not pasted into chat. Standard Keeper RBAC policies and audit logging apply.

---

Skills vs. MCP

Keeper supports two ways to connect AI agents. You can use both in the same environment.

	Agent Kit (Skills/Plugins)	MCP Server (Connector)
What it is	Markdown files that teach agents to use Keeper CLIs	A running Model Context Protocol server
How it connects	Agent reads skills, runs CLI commands locally	Agent connects to an MCP server process
Best for	Developer workflows, CI/CD, DevOps, local use	Agent orchestration platforms, hosted environments
Auth model	Your existing KSM/Commander CLI sessions	KSM one-time access tokens
Additional Information	This page	MCP (Docker)

---

Troubleshooting

Agent doesn't pick up the skill Check that the skill files landed in the correct directory for your agent. Restart your agent session after installing. In Claude Code, run /plugin and check the Installed tab.

ksm or keeper command not found The CLI tools need to be installed separately. Ask your agent "Help me install KSM CLI" and the keeper-setup skill will handle the rest.

Permission denied when running CLI commands Make sure your KSM profile or Commander session has the right permissions. Keeper's RBAC policies apply to all CLI access. Talk to your Keeper admin if you need additional role assignments.

Skills installed globally but not loading in a project Some agents prioritize project-level skills over global ones. If a project has its own skills directory, global skills may be hidden. Check with npx skills list or /plugin in Claude Code.

---

Resources

• GitHub: Keeper-Security/keeper-agent-kit

• KSM CLI Docs: Secrets Manager CLI

• Commander CLI Docs: Commander Overview

• Keeper Notation: keeper:// URI references

• Issues & Features: GitHub Issues

• Support: keepersecurity.com/support