API Locker

Encrypted credential vault with a 21-tool MCP server.

От сообществаРаботаетБез входаГлобальныйБесплатноТолько чтение

Что умеет

List Keys: List credentials in the user's vault grouped by category (LLM / Service / OAuth). Returns metadata only — never raw secret values. Optionally filter by category, provider, or tag.
Get Key Metadata: Get full metadata for one credential by its alias (name). Returns provider, type, tags, paused state, rotation history. Does not reveal the secret value.
Reveal Key: Reveal the decrypted value of a credential by alias. For api_key credentials, returns the single secret string. For oauth2 credentials, returns the full multi-field object (client_id, clie

Какие данные видит

Нужен ли аккаунт

Не нужен: сервер работает без входа

Encrypted credential vault with a 21-tool MCP server. Store and manage LLM API keys, service API keys, and OAuth credentials — then let your AI agent list, reveal, rotate, rename, pause, and proxy calls through them.

Список инструментов сервера (21)

Технические названия из tools/list. Нужны только разработчикам.

list_keys	List credentials in the user's vault grouped by category (LLM / Service / OAuth). Returns metadata only — never raw secret values. Optionally filter by category, provider, or tag.
get_key_metadata	Get full metadata for one credential by its alias (name). Returns provider, type, tags, paused state, rotation history. Does not reveal the secret value.
reveal_key	Reveal the decrypted value of a credential by alias. For api_key credentials, returns the single secret string. For oauth2 credentials, returns the full multi-field object (client_id, client_secret, refresh_token, etc.). The agent should treat the response as sensitive — log it, store it, or pass it carefully.
list_providers	List all available provider templates. Useful for discovering what providers can be used when storing new credentials.
get_activity	Get recent audit log entries showing how credentials have been used. Returns proxy calls, reveals, rotations, renames, pauses, etc. Each entry includes timestamp, status code, latency, and the credential involved.
run_doctor	Run a security health check on the vault. Returns warnings about stale rotations, unused keys, expiring tokens, stale devices. The same checks the CLI `apilocker doctor` command runs.
proxy_request	Make an API request through the locker proxy. The real API key is injected automatically — the agent never sees the raw secret. Use this when you need to call an external API (OpenAI, Stripe, etc.) using a stored credential.
store_key	Store a new api_key credential in the vault. The secret is encrypted with AES-GCM before being stored. Use store_oauth_credential for multi-field OAuth credentials. Requires master token auth.
store_oauth_credential	Store a new OAuth multi-field credential (client_id, client_secret, refresh_token, etc.). For OAuth providers like Google, GitHub, Slack, Microsoft, Notion, Spotify, Twitter, LinkedIn, Discord, Zoom, Dropbox, Salesforce, HubSpot. Requires master token auth.
rotate_key	Replace a credential's value in place with a new one. The credential's name, provider, and all metadata stay the same. Scoped tokens that reference the key continue to work. Requires master token auth.
rename_key	Rename a credential alias. The old name is remembered as a legacy alias forever, so existing references to the old name continue to work transparently. Requires master token auth.
pause_key	Pause proxy access for a credential without deleting it. Reveal/run/get/env operations still work on paused credentials. The proxy returns HTTP 423 for paused keys until they are resumed. Requires master token auth.
resume_key	Resume proxy access for a paused credential. Requires master token auth.
delete_key	Permanently delete a credential. The encrypted blob is removed from KV and the metadata row is removed from D1. This cannot be undone. Requires master token auth.
list_tokens	List scoped access tokens for the user's account. Each token authorizes proxy/MCP access to a specific subset of credentials. Requires master token auth.
create_token	Create a new scoped access token. Returns the access token and (for rotating tokens) the refresh token. Requires master token auth.
pause_token	Pause a scoped token. Paused tokens cannot be used until resumed. Requires master token auth.
resume_token	Resume a paused scoped token. Requires master token auth.
revoke_token	Permanently revoke (delete) a scoped token. Cannot be undone. Requires master token auth.
list_devices	List all devices registered to the user's account. Requires master token auth.
revoke_device	Revoke a registered device. The device's master token immediately stops working. Requires master token auth.