{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_zc7ebrdxaapf","handle":"seekrit-local-crypto-plane","url":"https://wellknown.network/agents/seekrit-local-crypto-plane","links":{"self":"https://wellknown.network/agents/seekrit-local-crypto-plane/record.json","html":"https://wellknown.network/agents/seekrit-local-crypto-plane","markdown":"https://wellknown.network/agents/seekrit-local-crypto-plane/record.md","api":"https://wellknown.network/api/v1/agents/seekrit-local-crypto-plane","status":"https://wellknown.network/api/v1/agents/seekrit-local-crypto-plane/status","claim":"https://wellknown.network/agents/seekrit-local-crypto-plane/claim","claimApi":"https://wellknown.network/api/v1/claims","badge":"https://wellknown.network/agents/seekrit-local-crypto-plane/badge.svg","openapi":"https://wellknown.network/openapi.json"},"ard":{"identifier":"urn:air:mcp.seekrit.dev:server:seekrit-local-crypto-plane","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"seekrit (local crypto plane)","summary":"Zero-knowledge secrets manager — local crypto-plane MCP server: decrypts and injects secrets.","description":"Zero-knowledge secrets manager — local crypto-plane MCP server: decrypts and injects secrets.","publisher":{"name":"dev.seekrit","url":null},"homepage":null,"repository":"https://github.com/mileszim/seekrit","version":"0.8.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://mcp.seekrit.dev/mcp","type":"mcp_streamable_http","auth":null,"probeable":true},{"url":"npm:@seekrit/mcp","type":"package_npm","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-08-23T05:01:26.367706Z","publishedAt":"2026-08-23T05:01:26.367706Z","registryName":"dev.seekrit/mcp"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"derived"},{"slug":"finance.markets","name":"Markets & Trading","confidence":1,"provenance":"derived"},{"slug":"security.secrets","name":"Secrets Management","confidence":1,"provenance":"derived"},{"slug":"dev.docs-lookup","name":"Documentation Lookup","confidence":0.54,"provenance":"derived"},{"slug":"infra.browser-automation","name":"Browser Automation","confidence":0.51,"provenance":"derived"}],"categories":["data","dev","finance","infra","security"]},"observed":{"status":"live","statusReason":"Responded 6h ago.","lastOkAt":"2026-09-06T01:23:42.613Z","lastProbedAt":"2026-09-06T01:23:42.613Z","statusComputedAt":"2026-09-06T01:24:39.791Z","reliability30d":{"probes":1,"successRate":1,"p50Ms":377},"latestObservations":[{"at":"2026-09-06T01:23:42.613Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":377,"error":null,"detail":{"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"toolCount":40,"serverName":"seekrit","capabilities":["tools"],"serverVersion":"0.0.1","protocolVersion":"2025-06-18"}}],"tools":[{"name":"signup","description":"Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on "},{"name":"get_started","description":"Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr"},{"name":"setup_local_crypto","description":"Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-"},{"name":"local_tool_for","description":"Look up how to perform one crypto-plane operation locally — the targeted answer for \"the tool I expected is not on this server\". Returns { operation, where, how"},{"name":"whoami","description":"Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that"},{"name":"list_orgs","description":"List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client "},{"name":"list_apps","description":"List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know"},{"name":"list_envs","description":"List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t"},{"name":"list_branches","description":"List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only "},{"name":"list_groups","description":"List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c"},{"name":"list_group_envs","description":"List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when"},{"name":"list_env_groups","description":"List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n"},{"name":"list_members","description":"List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr"},{"name":"list_secrets","description":"List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing "},{"name":"list_secret_versions","description":"List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a "},{"name":"list_tokens","description":"List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a"},{"name":"list_invites","description":"List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo"},{"name":"kms_list_keys","description":"List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k"},{"name":"list_lease_targets","description":"List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori"},{"name":"list_leases","description":"List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred"},{"name":"audit","description":"Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer \"w"},{"name":"billing","description":"Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit "},{"name":"create_app","description":"Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N"},{"name":"create_group","description":"Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping "},{"name":"compose_group","description":"Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea"},{"name":"uncompose_group","description":"Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin"},{"name":"invite_member","description":"Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant"},{"name":"rename_app","description":"Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap"},{"name":"rename_group","description":"Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated"},{"name":"restore_secret","description":"Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i"},{"name":"delete_secret","description":"Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi"},{"name":"revoke_token","description":"Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may"},{"name":"revoke_invite","description":"Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l"},{"name":"revoke_lease","description":"Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still"},{"name":"kms_disable_key","description":"Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers"},{"name":"kms_revoke_grant","description":"Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor"},{"name":"delete_app","description":"Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is"},{"name":"delete_group","description":"Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi"},{"name":"delete_env","description":"Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th"},{"name":"delete_branch","description":"Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th"}],"package":null},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"dev.seekrit/mcp","url":"https://registry.modelcontextprotocol.io/v0/servers/dev.seekrit%2Fmcp","firstSeenAt":"2026-09-05T23:20:58.367Z","fetchedAt":"2026-09-05T23:20:58.367Z","normalizedAt":"2026-09-05T23:20:58.367Z"},{"source":"mcp_registry","key":"dev.seekrit/remote-mcp","url":"https://registry.modelcontextprotocol.io/v0/servers/dev.seekrit%2Fremote-mcp","firstSeenAt":"2026-09-05T23:20:58.367Z","fetchedAt":"2026-09-05T23:20:58.367Z","normalizedAt":"2026-09-05T23:20:58.367Z"}]},"firstSeenAt":"2026-09-05T23:20:58.367Z","updatedAt":"2026-09-06T01:24:47.062Z"}