AgentSecrets

🔐 Zero-Knowledge Encrypted Secrets Vault for AI Agents & Developers AgentSecrets is a secure, free, lightweight secrets management vault built specifically…

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • Get Secret: Retrieve and decrypt a secret value from the AgentSecrets vault by key. Note: if the secret was configured as burn-after-reading, it will be deleted after this call.
  • Set Secret: Encrypt and store a secret value in the AgentSecrets vault. Supports string or structured JSON data, optional TTL expiration, and burn-after-reading mode.
  • List Secrets: List all active secret keys and their metadata (TTL, burn status, creation date) without exposing secret values.

What data it sees

Do you need an account

No: the server works without sign-in

🔐 Zero-Knowledge Encrypted Secrets Vault for AI Agents & Developers

AgentSecrets is a secure, free, lightweight secrets management vault built specifically for autonomous AI agents, LLM toolchains, and developer workflows (Claude Desktop, Cursor, Windsurf, LangChain).

🌟 100% Free & Completely Anonymous

  • No Email, No Phone, No KYC: Instant 1-click registration — no personal data collected.
  • Completely Free: Free tier with zero subscriptions and no credit card required.
  • Autonomous-First: Designed so human developers and AI agents can mint tokens programmatically.

🛡️ Core Capabilities

  • 🔒 AES-256-GCM Encryption: High-grade zero-knowledge encryption for all credentials and keys.
  • 🔥 Burn-After-Reading: One-time secrets that automatically self-destruct immediately after first read.
  • ⏳ Automatic TTL Expiration: Ephemeral secrets that vanish after a set period (seconds to days).
  • 🎯 Scoped Subagent Delegation: Mint child tokens with read-only or prefix restrictions (e.g. stripe/*) to safely delegate access to downstream subagents.
  • ⚡ Blazing Fast MCP Integration: Native Server-Sent Events (SSE) and Streamable HTTP transport for zero-latency tool calls.

🚀 Quick Start (Under 30 Seconds)

  1. Go to agentsecrets.net and click "Instant Register" to get your free as_live_... API token.
  2. Enter the token when installing this MCP server.
  3. Your AI agent can now safely store and fetch secrets without ever leaking them into raw chat context!

How to connect

How to connect AgentSecrets to Claude

The server address to paste into Claude settings:

https://agentsecrets--id41864819.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect AgentSecrets to ChatGPT

The server address to paste into ChatGPT settings:

https://agentsecrets--id41864819.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect AgentSecrets to Cursor

The server address to paste into Cursor settings:

https://agentsecrets--id41864819.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (15)

Raw names from tools/list. Only developers need these.

get_secretRetrieve and decrypt a secret value from the AgentSecrets vault by key. Note: if the secret was configured as burn-after-reading, it will be deleted after this call.
set_secretEncrypt and store a secret value in the AgentSecrets vault. Supports string or structured JSON data, optional TTL expiration, and burn-after-reading mode.
list_secretsList all active secret keys and their metadata (TTL, burn status, creation date) without exposing secret values.
delete_secretPermanently remove a secret from the AgentSecrets vault.
get_my_credentialsRetrieve the credentials (API token and agent ID) for this autonomous vault. Use this to persist your token locally (e.g. in ~/.agentsecrets/credentials.json or .env) so you can reconnect across restarts, or share with a human operator to claim this vault.
get_agent_contextOne-call session startup inspection: identity, token scope, vault quota, keys expiring soon, recently used keys, and prioritized next actions. Call this at the start of a task instead of several separate calls.
register_agentInstantly register a new agent account and obtain a persistent Bearer token plus a 12-word recovery phrase. No email, captcha, or human verification. Prefer zero-config MCP provisioning when possible; use this only when you need a named REST account.
recover_accountRecover access to an existing account and set a new password using the 12-word recovery phrase issued at registration. Use this after HTTP 401 instead of registering a duplicate account.
get_secret_rawRetrieve a secret as a raw plaintext string (text/plain) instead of JSON. Use this when capturing a value into an environment variable, so no JSON parsing is needed. A missing key returns a plain-text error, never JSON.
rollback_secretRevert a secret to a previous version snapshot. The vault keeps the three most recent snapshots per secret. Use this after an accidental or corrupted update.
export_secrets_shellExport active secrets as a shell script of 'export KEY=VAL' lines, optionally filtered by environment. Feed the result to a shell to load many secrets at once. Burn-after-read secrets are intentionally skipped so the export never destroys them.
mint_scoped_tokenMint a delegated token for a sub-agent so it cannot exceed its mandate. Use scope 'read_only' to forbid all writes and deletes, 'prefix:<str>' to confine it to keys beginning with that prefix, or 'prefix:ro:<str>' for a read-only prefix.
get_profile_notesRetrieve the encrypted profile notes and scratchpad stored for this account. Use it to persist agent instructions, configuration, or a task description across restarts.
set_profile_notesSave encrypted notes or a scratchpad for this account. Use it to keep long-lived agent configuration, a task description, or resume context between sessions.
claim_agentBridge an autonomous agent vault into the authenticated human account by presenting the agent's token. Use this when a human operator wants to take ownership of a vault an agent provisioned for itself.