The Keyblind server enables AI agents to securely manage sensitive information by encrypting, storing, resolving, and sandboxing secrets — ensuring plaintext values are never exposed in LLM conversation transcripts.

• resolve_secret: Retrieve and decrypt a stored secret by name (e.g., OPENAI_API_KEY, DATABASE_URL) from the configured backend (local vault, 1Password, Bitwarden, or environment variables) — the value is never visible in the conversation transcript.

• store_secret: Encrypt and store a new secret in the vault using AES-256-GCM encryption.

• list_secrets: List all stored secret names without ever revealing their actual values.

• sandbox_env: Replace real .env values with deterministic fakes, backing up the real values to the encrypted vault so AI agents only see placeholder data.

• unsandbox_env: Restore the original real .env values from the vault, reversing a previous sandbox operation.

• delete_secret: Permanently remove a secret from the vault by name.

Allows reading and writing secrets from 1Password vaults using the op CLI.

Allows reading secrets from Bitwarden vaults using the bw CLI (read-only).

Allows reading secrets from .env files (read-only).

┌──────────┐ ┌────────────────┐ ┌─────────────────┐
│ AI Agent │ ──→ │ Keyblind MCP │ ──→ │ Encrypted │
│ (Claude) │ │ Server │ │ SQLite Vault │
│ │ ←── │ (16 tools) │ ←── │ (AES-256-GCM) │
└──────────┘ └────────────────┘ └─────────────────┘
 ↑ │
 │ secret value never appears │ secrets never
 │ in conversation transcript │ stored in plaintext

# 1. Install
npm i -g keyblind

# 2. Initialize your vault
keyblind init

# 3. Auto-configure MCP for Claude Code (one command)
keyblind setup-mcp

# 4. Store secrets
echo "sk-proj-abc123" | keyblind set OPENAI_API_KEY
keyblind set DATABASE_URL - # prompts securely

# 5. Sandbox your .env (AI agents see fakes)
keyblind sandbox

# 6. Resolve a secret
keyblind get OPENAI_API_KEY

# 7. Run commands with secrets injected as env vars
keyblind run -- npm start

# 8. List all secrets (names only, values hidden)
keyblind list

keyblind setup-mcp

claude mcp add --scope user keyblind -- keyblind start

keyblind unlock # Authenticate first
claude mcp add keyblind -- keyblind start --biometric

keyblind start --http

# Buy a license at keyblind.dev, then activate:
keyblind activate <your-license-key>

# Check your status
keyblind status

keyblind backends # List available backends
keyblind backend 1password # Switch to 1Password
keyblind backend bitwarden # Switch to Bitwarden

keyblind init Initialize the encrypted vault
keyblind set <name> Store a secret (value from stdin)
keyblind set <name> - Store a secret (prompts securely)
keyblind get <name> Resolve and print a secret
keyblind list List all stored secrets
keyblind delete <name> Delete a secret
keyblind setup-mcp Auto-configure MCP for Claude Code
keyblind sandbox [.env] Replace .env with deterministic fakes
keyblind unsandbox [.env] Restore real .env values
keyblind run <command...> Run command with secrets as env vars
keyblind start Start MCP server (stdio — for AI agents)
keyblind start --http Start MCP HTTP server (for dashboard)
keyblind start --biometric Start MCP server with biometric requirement
keyblind backends List available backends
keyblind backend <name> Switch backend
keyblind activate <key> Activate a Pro/Team license
keyblind deactivate Remove current license
keyblind status Show license and vault status
keyblind audit Show secret resolution audit log
keyblind check --expired List secrets past expiry
keyblind rotate <name> Update a secret value
keyblind team init [path] Create a shared team vault
keyblind team push <name> Push a secret to team vault
keyblind team pull Pull secrets from team vault
keyblind team list List secrets in team vault
keyblind totp set <name> Store TOTP 2FA config
keyblind totp code <name> Generate current TOTP code
keyblind totp list List all TOTP configs
keyblind totp delete <name> Delete a TOTP config
keyblind share <name> Create encrypted share link
keyblind receive <url> Receive a shared secret
keyblind deadman setup Configure dead man's switch
keyblind deadman checkin Reset dead man's switch timer
keyblind deadman status Show dead man's switch status
keyblind deadman disable Disable dead man's switch
keyblind sso configure Set up SSO/OIDC for team access
keyblind sso login Authenticate via browser SSO
keyblind sso logout Clear SSO session
keyblind sso status Show SSO auth status
keyblind doctor Run vault health check
keyblind generate <name> Generate a strong random secret
keyblind import [.env] Bulk import from .env file
keyblind export Export all secrets
keyblind completions [shell] Generate shell completion script

git clone https://github.com/aarifmms/keyblind.git
cd keyblind
npm install
npm run build # Compile TypeScript
npm test # Run tests
npm run dev # Watch mode