API Locker

Encrypted credential vault with a 21-tool MCP server.

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

  • List Keys: List credentials in the user's vault grouped by category (LLM / Service / OAuth). Returns metadata only — never raw secret values. Optionally filter by category, provider, or tag.
  • Get Key Metadata: Get full metadata for one credential by its alias (name). Returns provider, type, tags, paused state, rotation history. Does not reveal the secret value.
  • Reveal Key: Reveal the decrypted value of a credential by alias. For api_key credentials, returns the single secret string. For oauth2 credentials, returns the full multi-field object (client_id, clie

What data it sees

Do you need an account

No: the server works without sign-in

Encrypted credential vault with a 21-tool MCP server. Store and manage LLM API keys, service API keys, and OAuth credentials — then let your AI agent list, reveal, rotate, rename, pause, and proxy calls through them.

How to connect

How to connect API Locker to Claude

The server address to paste into Claude settings:

https://apilocker--asancivieri.run.tools

  1. Open Claude (claude.ai or the desktop app).
  2. Go to Settings → Connectors.
  3. Click Add custom connector.
  4. Paste the server address copied below into Remote MCP server URL and click Add.
  5. In a chat, click + → Connectors and switch the new connector on.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

Authorization

After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

How to connect API Locker to ChatGPT

The server address to paste into ChatGPT settings:

https://apilocker--asancivieri.run.tools

  1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
  2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
  3. Open Settings → Connectors and click Create.
  4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
  5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
  6. In a new chat open + → Apps/Connectors and enable the connector.

OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

Authorization

On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

How to connect API Locker to Cursor

The server address to paste into Cursor settings:

https://apilocker--asancivieri.run.tools

Fastest: click Open in Cursor below and confirm the prompt.

Manually:

  1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
  2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
  3. Save the file. The server appears in the MCP list; authorize it there if asked.

Authorization

If the service needs sign-in, an authorize button appears next to the server in the MCP list.

Server tool list (21)

Raw names from tools/list. Only developers need these.

list_keysList credentials in the user's vault grouped by category (LLM / Service / OAuth). Returns metadata only — never raw secret values. Optionally filter by category, provider, or tag.
get_key_metadataGet full metadata for one credential by its alias (name). Returns provider, type, tags, paused state, rotation history. Does not reveal the secret value.
reveal_keyReveal the decrypted value of a credential by alias. For api_key credentials, returns the single secret string. For oauth2 credentials, returns the full multi-field object (client_id, client_secret, refresh_token, etc.). The agent should treat the response as sensitive — log it, store it, or pass it carefully.
list_providersList all available provider templates. Useful for discovering what providers can be used when storing new credentials.
get_activityGet recent audit log entries showing how credentials have been used. Returns proxy calls, reveals, rotations, renames, pauses, etc. Each entry includes timestamp, status code, latency, and the credential involved.
run_doctorRun a security health check on the vault. Returns warnings about stale rotations, unused keys, expiring tokens, stale devices. The same checks the CLI `apilocker doctor` command runs.
proxy_requestMake an API request through the locker proxy. The real API key is injected automatically — the agent never sees the raw secret. Use this when you need to call an external API (OpenAI, Stripe, etc.) using a stored credential.
store_keyStore a new api_key credential in the vault. The secret is encrypted with AES-GCM before being stored. Use store_oauth_credential for multi-field OAuth credentials. Requires master token auth.
store_oauth_credentialStore a new OAuth multi-field credential (client_id, client_secret, refresh_token, etc.). For OAuth providers like Google, GitHub, Slack, Microsoft, Notion, Spotify, Twitter, LinkedIn, Discord, Zoom, Dropbox, Salesforce, HubSpot. Requires master token auth.
rotate_keyReplace a credential's value in place with a new one. The credential's name, provider, and all metadata stay the same. Scoped tokens that reference the key continue to work. Requires master token auth.
rename_keyRename a credential alias. The old name is remembered as a legacy alias forever, so existing references to the old name continue to work transparently. Requires master token auth.
pause_keyPause proxy access for a credential without deleting it. Reveal/run/get/env operations still work on paused credentials. The proxy returns HTTP 423 for paused keys until they are resumed. Requires master token auth.
resume_keyResume proxy access for a paused credential. Requires master token auth.
delete_keyPermanently delete a credential. The encrypted blob is removed from KV and the metadata row is removed from D1. This cannot be undone. Requires master token auth.
list_tokensList scoped access tokens for the user's account. Each token authorizes proxy/MCP access to a specific subset of credentials. Requires master token auth.
create_tokenCreate a new scoped access token. Returns the access token and (for rotating tokens) the refresh token. Requires master token auth.
pause_tokenPause a scoped token. Paused tokens cannot be used until resumed. Requires master token auth.
resume_tokenResume a paused scoped token. Requires master token auth.
revoke_tokenPermanently revoke (delete) a scoped token. Cannot be undone. Requires master token auth.
list_devicesList all devices registered to the user's account. Requires master token auth.
revoke_deviceRevoke a registered device. The device's master token immediately stops working. Requires master token auth.