Model Context Protocol (MCP) for AI Agents (Node)
Integrate Keeper Secrets Manager into AI agents using Node
Last updated
Was this helpful?
Integrate Keeper Secrets Manager into AI agents using Node
Last updated
Was this helpful?
Keeper Secrets Manager works with AI agents through the Model Context Protocol (MCP), enabling AI Agents to securely interact with specific vault folders. This integration provides a zero-trust architecture where AI agents are explicitly allowed to access designated information from the Keeper Vault.
The Model Context Protocol integration acts as a secure bridge between AI assistants and Keeper Secrets Manager. It allows AI tools to help you manage secrets while maintaining the highest security standards through human-in-the-loop confirmations for sensitive operations.
Zero Trust Architecture: AI agents are assigned specific folders in the vault Human-in-the-Loop: Confirmation prompts for sensitive operations Enterprise Ready: Comprehensive audit logging and compliance features Multi-Platform: Works on Linux, macOS, and Windows
With KSM MCP integration, AI assistants can help you:
List secrets - Browse your accessible secrets Search secrets - Find secrets by title, URL, username, or other fields Retrieve secrets - Get specific secret values (with confirmation for unmasked data) Create secrets - Generate new secret entries Update secrets - Modify existing secret information Delete secrets - Remove secrets (with confirmation)
List attachments - View file attachments on secrets Upload files - Add file attachments to secrets Download files - Retrieve file attachments Delete files - Remove file attachments
Generate passwords - Create secure passwords with customizable parameters Get TOTP codes - Retrieve current time-based one-time passwords Execute KSM notation queries - Use Keeper's notation system for complex operations Health checks - Monitor server status and connectivity
From Keeper Secrets Manager, create an Application or use an existing application.
Discard the first Device token, and click on "Add Device" to generate a new Base64 configuration that will be provided to your AI agent.
You have two options for providing your Keeper configuration:
Place your downloaded configuration file in one of these locations:
~/.keeper/ksm-config.json
(recommended)
./ksm-config.json
(in the current directory)
If you have a one-time token instead:
export KSM_TOKEN="US:YOUR_ONE_TIME_TOKEN_HERE"
The server will use this token to generate and save a configuration file automatically.
Run the server directly to test:
npm start
You should see: Keeper MCP server is running
Add to your Claude Desktop configuration (~/Library/Application Support/Claude/claude_desktop_config.json
):
{
"mcpServers": {
"keeper": {
"command": "node",
"args": ["/path/to/keeper-mcp-node/dist/index.js"]
}
}
}
In Postman, go to the API Network tab
Create or select an MCP request
Configure the stdio connection:
Command: node
Arguments: /path/to/keeper-mcp-node/dist/index.js
The server communicates via stdio, so you can integrate it with any MCP-compatible client by running:
node /path/to/keeper-mcp-node/dist/index.js
ksm_list_secrets
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_list_secrets",
"arguments": {}
}
}
Response:
[
{
"uid": "XXXXXXXXXXXXXXXXXXXXXX",
"title": "My Secret",
"type": "login"
}
]
ksm_get_secret
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_get_secret",
"arguments": {
"identifier": "My Secret",
"unmask": false
}
}
}
ksm_search_secrets
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_search_secrets",
"arguments": {
"query": "database"
}
}
}
ksm_create_secret
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_create_secret",
"arguments": {
"title": "New Database Credentials",
"type": "login",
"fields": {
"login": "admin",
"password": "secure_password",
"url": "https://db.example.com"
},
"notes": "Production database",
"folderId": "FOLDER_UID"
}
}
}
ksm_update_secret
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_update_secret",
"arguments": {
"identifier": "My Secret",
"updates": {
"title": "Updated Title",
"fields": {
"password": "new_password"
}
}
}
}
}
ksm_delete_secret
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_delete_secret",
"arguments": {
"identifier": "My Secret"
}
}
}
ksm_get_field
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_get_field",
"arguments": {
"identifier": "My Secret",
"field": "password"
}
}
}
Common field names:
password
- The password field
login
- Username/email
url
- Website URL
Custom field labels
ksm_list_folders
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_list_folders",
"arguments": {}
}
}
ksm_create_folder
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_create_folder",
"arguments": {
"name": "Development Secrets",
"parentFolderId": "PARENT_FOLDER_UID"
}
}
}
ksm_delete_folder
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_delete_folder",
"arguments": {
"folderId": "FOLDER_UID",
"force": false
}
}
}
ksm_upload_file
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_upload_file",
"arguments": {
"identifier": "My Secret",
"filePath": "/path/to/certificate.pem",
"fileName": "server-cert.pem"
}
}
}
ksm_download_file
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_download_file",
"arguments": {
"identifier": "My Secret",
"fileId": "certificate.pem",
"outputPath": "/tmp/downloaded-cert.pem"
}
}
}
ksm_generate_password
Can optionally save to a new secret without exposing it to the AI
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_generate_password",
"arguments": {
"length": 24,
"includeUppercase": true,
"includeLowercase": true,
"includeNumbers": true,
"includeSpecial": true,
"saveToSecret": {
"title": "Generated API Key",
"login": "api-user",
"url": "https://api.example.com",
"notes": "Auto-generated API key"
}
}
}
}
ksm_get_totp_code
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_get_totp_code",
"arguments": {
"identifier": "My 2FA Secret"
}
}
}
ksm_get_server_version
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_get_server_version",
"arguments": {}
}
}
ksm_health_check
Request:
{
"method": "tools/call",
"params": {
"name": "ksm_health_check",
"arguments": {}
}
}
Ensure your configuration file is in one of the supported locations
Check that the file has proper JSON formatting
Verify file permissions (should be readable by your user)
Verify your configuration file contains all required fields
Check that your application has access to the shared folders/secrets
Ensure your device hasn't been revoked in Keeper
Verify you have internet connectivity
Check if your organization has IP restrictions enabled
Ensure your Keeper subscription includes Secrets Manager
For additional setup details, see: https://github.com/Keeper-Security/keeper-mcp-node/