# AI Agents Use AI coding agents with Keeper to retrieve secrets, manage vaults, and run admin workflows from the terminal. Credentials stay out of chat and source control. > **GitHub:** [github.com/Keeper-Security/keeper-agent-kit](https://github.com/Keeper-Security/keeper-agent-kit) ***
### Overview Keeper supports two integration models for AI agents: **skills/plugins** for CLI-driven developer workflows, and **MCP servers** for agent orchestration platforms. This page covers the **Keeper Agent Kit**, a set of skills (also called plugins) that teach AI coding agents how to use Keeper's CLI tools. After installation, your agent can: * **Retrieve and inject secrets** with `ksm` (Keeper Secrets Manager CLI) * **Manage vaults, users, teams, and PAM resources** with `keeper` (Commander CLI) * **Set up both CLIs from scratch** if they aren't installed yet Credentials never appear in chat or get committed to source control. The KSM CLI and Commander CLI resolve secrets at runtime. All access is subject to the same RBAC policies and audit logging as any other Keeper integration. For the MCP-based approach see [MCP for AI Agents (Docker)](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/..#model-context-protocol-mcp-for-ai-agents-docker). *** ### What's Included The Agent Kit contains three skills: | Skill | What it does | CLI used | | ------------------ | --------------------------------------------------- | -------- | | **keeper-secrets** | App secrets, `ksm exec`, templates, CI/CD injection | `ksm` | | **keeper-admin** | Users, teams, PAM, enterprise vault operations | `keeper` | | **keeper-setup** | Install CLIs, configure profiles, first-time setup | Both | *** ### Prerequisites You'll need: * A [Keeper Security](https://keepersecurity.com/) account (Business or Enterprise) * Python 3.10 or later * macOS, Linux, or Windows The KSM CLI and Commander CLI can be installed manually, or you can let the `keeper-setup` skill walk your agent through first-time setup. | CLI | Install Docs | | ------------- | ----------------------------------------------------------------------------------------------------------------- | | KSM CLI | [Secrets Manager CLI](https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface) | | Commander CLI | [Commander Installation](https://docs.keeper.io/en/keeperpam/commander-cli) | *** ### Installation Choose the guide that matches your setup: | Method | Best for | Guide | | ----------------------------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | **Claude Plugin Marketplace** | Claude users | [Install with Claude](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/ai-agents/claude) | | **Skills CLI (`npx skills`)** | Cursor, Codex, Copilot, and multi-agent setups | [Install with Skills CLI](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/ai-agents/skills-cli) | | **Manual (git clone)** | Air-gapped environments, custom agent setups | [Install Manually](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/ai-agents/manual-install) | All three methods install the same skills. Pick whichever fits your workflow. *** ### Supported Agents | Agent | Plugin Marketplace | Skills CLI | Manual | | ---------------------- | ------------------ | --------------- | ------ | | Claude Code | ✅ | ✅ | ✅ | | Cursor | ✅ | ✅ | ✅ | | Codex | — | ✅ | ✅ | | GitHub Copilot | — | ✅ | ✅ | | VS Code (Copilot Chat) | — | ✅ | ✅ | | Other agents | — | ✅ (auto-detect) | ✅ | *** ### Quick Start After installing, use your agent as usual. Skills activate based on context. **Inject a secret into your environment:** > "Help me inject my database credentials from Keeper into my app's `.env` file" The agent uses **keeper-secrets** to run `ksm exec` and pull the secret in without showing it in chat. **Set up KSM for the first time:** > "I need to configure Keeper Secrets Manager on this machine" The agent uses **keeper-setup** to walk you through CLI installation, profile creation, and token setup. **Look up a user in your Keeper enterprise:** > "List all users on the Engineering team in Keeper" The agent uses **keeper-admin** to run the right Commander command. For more examples, see our sample [Test Prompts](https://github.com/Keeper-Security/keeper-agent-kit/blob/main/TEST_PROMPTS.md) in the repo. *** ### How It Works Skills are markdown files (`SKILL.md`) that tell your AI agent how to use a CLI tool. They're not executable code. Each skill documents commands, flags, and error-handling patterns. When you ask a question, the agent reads the relevant skill and builds the right CLI commands from it. ```bash keeper-agent-kit/ ├── plugins/ │ ├── keeper-secrets/ # KSM CLI skill │ │ └── skills/keeper-secrets/SKILL.md │ ├── keeper-admin/ # Commander CLI skill │ │ └── skills/keeper-admin/SKILL.md │ └── keeper-setup/ # Setup & install skill │ └── skills/keeper-setup/SKILL.md ``` **Security model:** The agent runs CLI commands on your local machine using your authenticated session. Secrets are resolved by the KSM and Commander CLIs at runtime, not pasted into chat. Standard Keeper RBAC policies and audit logging apply. *** ### Skills vs. MCP Keeper supports two ways to connect AI agents. You can use both in the same environment. | | Agent Kit (Skills/Plugins) | MCP Server (Connector) | | -------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | **What it is** | Markdown files that teach agents to use Keeper CLIs | A running Model Context Protocol server | | **How it connects** | Agent reads skills, runs CLI commands locally | Agent connects to an MCP server process | | **Best for** | Developer workflows, CI/CD, DevOps, local use | Agent orchestration platforms, hosted environments | | **Auth model** | Your existing KSM/Commander CLI sessions | KSM one-time access tokens | | **Additional Information** | This page | [MCP (Docker)](https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/..#model-context-protocol-mcp-for-ai-agents-docker) | *** ### Troubleshooting **Agent doesn't pick up the skill** Check that the skill files landed in the correct directory for your agent. Restart your agent session after installing. In Claude Code, run `/plugin` and check the **Installed** tab. **`ksm` or `keeper` command not found** The CLI tools need to be installed separately. Ask your agent "Help me install KSM CLI" and the **keeper-setup** skill will handle the rest. **Permission denied when running CLI commands** Make sure your KSM profile or Commander session has the right permissions. Keeper's RBAC policies apply to all CLI access. Talk to your Keeper admin if you need additional role assignments. **Skills installed globally but not loading in a project** Some agents prioritize project-level skills over global ones. If a project has its own skills directory, global skills may be hidden. Check with `npx skills list` or `/plugin` in Claude Code. *** ### Resources * **GitHub:** [Keeper-Security/keeper-agent-kit](https://github.com/Keeper-Security/keeper-agent-kit) * **KSM CLI Docs:** [Secrets Manager CLI](https://docs.keeper.io/en/keeperpam/secrets-manager/secrets-manager-command-line-interface) * **Commander CLI Docs:** [Commander Overview](https://docs.keeper.io/en/keeperpam/commander-cli/overview) * **Keeper Notation:** [keeper:// URI references](https://docs.keeper.io/en/keeperpam/secrets-manager/about/keeper-notation) * **Issues & Features:** [GitHub Issues](https://github.com/Keeper-Security/keeper-agent-kit/issues) * **Support:** [keepersecurity.com/support](https://keepersecurity.com/support)