Model Context Protocol (MCP) for AI Agents (Docker)

Integrate Keeper Secrets Manager into AI agents using Docker

AI Agent Integration with Model Context Protocol (MCP)

Keeper Secrets Manager works with AI agents through the Model Context Protocol (MCP), enabling AI Agents to securely interact with specific vault folders. This integration provides a zero-trust architecture where AI agents are explicitly allowed to access designated information from the Keeper Vault.

The Model Context Protocol integration acts as a secure bridge between AI assistants and Keeper Secrets Manager. It allows AI tools to help you manage secrets while maintaining the highest security standards through human-in-the-loop confirmations for sensitive operations.

GitHub - Keeper-Security/keeper-mcp-golang-docker: Keeper Secrets Manager - MCP (Model Context Protocol) server implementationGitHub

Key Benefits

Zero Trust Architecture: AI agents are assigned specific folders in the vault Human-in-the-Loop: Confirmation prompts for sensitive operations Enterprise Ready: Comprehensive audit logging and compliance features Multi-Platform: Works on Linux, macOS, and Windows Docker Native: Easy deployment with container support

What Can AI Assistants Do?

With KSM MCP integration, AI assistants can help you:

Secret Operations

List secrets - Browse your accessible secrets Search secrets - Find secrets by title, URL, username, or other fields Retrieve secrets - Get specific secret values (with confirmation for unmasked data) Create secrets - Generate new secret entries Update secrets - Modify existing secret information Delete secrets - Remove secrets (with confirmation)

File Management

List attachments - View file attachments on secrets Upload files - Add file attachments to secrets Download files - Retrieve file attachments Delete files - Remove file attachments

Utilities

Generate passwords - Create secure passwords with customizable parameters Get TOTP codes - Retrieve current time-based one-time passwords Execute KSM notation queries - Use Keeper's notation system for complex operations Health checks - Monitor server status and connectivity

Setup and Installation

Limit access to the AI Agent to only the minimum necessary folders in the Keeper Vault that are required to accomplish your desired use case. Follow all corporate policies regarding AI usage. Refer to your AI client application's privacy policy.

(1) Create Secrets Manager Application

From Keeper Secrets Manager, create an Application or use an existing application.

Create an Application and assign folders

(2) Create a Device Token

Discard the first Device token, and click on "Add Device" to generate a new Base64 configuration that will be provided to your AI agent.

Generate Base64 Token

(3) Register the MCP server

From your AI Agent configuration screen, register the Keeper Secrets Manager MCP server.

The specific details vary between AI agent applications. In Claude Desktop, this can be set up by opening Settings > Developer and then clicking Edit Config. Add the "ksm" server to this file, making sure to include the Base 64 configuration string generated in step 2.

{
  "mcpServers": {
    "ksm": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "KSM_CONFIG_BASE64=<KSM_CONFIG_BASE64_HERE>",
        "-e", "KSM_MCP_PROFILE=production",
        "-e", "KSM_MCP_BATCH_MODE=true",
        "-e", "KSM_MCP_LOG_LEVEL=error",
        "-v", "ksm-mcp-data:/home/ksm/.keeper/ksm-mcp",
        "keeper/keeper-mcp-server:latest"
      ]
    }
  }
}

Claude Desktop Integration

Once this is set, you can begin interacting with the Keeper Secrets Manager MCP server.

Interacting with the KSM MCP Server

Generating a Password

Logs and event reporting are available inside the device logs screen and the Keeper Admin Console screens.

Event logs

---

For additional setup details, see: https://github.com/Keeper-Security/keeper-mcp-golang-docker