seekrit — secrets for agents

Name: seekrit — secrets for agents
Author: dev.seekrit

MCP serverMCP

Encrypted store for API keys and database URLs your code needs. Use them without reading them.

Listed on its own since 2026-09-27. Until then it was part of seekrit-local-crypto-plane, where its earlier checks remain.

by dev.seekritrepository ↗v0.1.0

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"seekrit-secrets-for-agents","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability46/46 checks ok

Tools observed via MCP handshake

signup — Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on
get_started — Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthr
setup_local_crypto — Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-
local_tool_for — Look up how to perform one crypto-plane operation locally — the targeted answer for "the tool I expected is not on this server". Returns { operation, where, how
whoami — Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that
list_orgs — List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client
list_apps — List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know
list_envs — List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and t
list_branches — List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only
list_groups — List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can c
list_group_envs — List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when
list_env_groups — List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret n
list_members — List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decr
list_secrets — List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing
list_secret_versions — List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a
list_tokens — List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once a
list_invites — List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revo
kms_list_keys — List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: k
list_lease_targets — List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of stori
list_leases — List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the cred
audit — Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer "w
billing — Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit
create_app — Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does N
create_group — Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping
compose_group — Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an alrea
uncompose_group — Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolvin
invite_member — Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant
rename_app — Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_ap
rename_group — Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated
restore_secret — Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing i
delete_secret — Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back withi
revoke_token — Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may
revoke_invite — Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no l
revoke_lease — Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still
kms_disable_key — Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Revers
kms_revoke_grant — Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps wor
delete_app — Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is
delete_group — Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed thi
delete_env — Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating th
delete_branch — Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this th

when	check	result	http	latency	detail
5 h ago	mcp initialize	ok	200	937 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
11 h ago	mcp initialize	ok	200	612 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
18 h ago	mcp initialize	ok	200	848 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
25 h ago	mcp initialize	ok	200	482 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
32 h ago	mcp initialize	ok	200	717 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
2 d ago	mcp initialize	ok	200	1041 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
2 d ago	mcp initialize	ok	200	727 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
2 d ago	mcp initialize	ok	200	699 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
2 d ago	mcp initialize	ok	200	756 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools
3 d ago	mcp initialize	ok	200	726 ms	server seekrit 0.0.1 · protocol 2025-06-18 · 40 tools

seekrit — secrets for agents

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from