Phantom Secrets MCP Server

by ashlrai Your server? Claim it

local only

Phantom Secrets runs on your own machine — the client starts it, so there is no endpoint to ping. 95 installs a week from npm. Last commit 2 Nov 2026.

Value-blind secret metadata and gated workflows for AI coding agents through Phantom's local proxy.

Installs per day peak 226 · avg 15 · +506% w/w

a month agotoday

Installs / week

npm · phantom-secrets-mcp

Stars

1 open issue

2 Nov 2026

Last commit

2 releases in 90 days

MIT

License

Rust

What the code does

We read the source, 23 h ago · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs a command on install [пакет] package.json:1

postinstall: node install.js

Runs an external command [пакет] bin/cli.js:917, npm/bin/cli.js:1062, npm-mcp/bin/cli.js:931

    execFileSync(binary, process.argv.slice(2), { stdio: "inherit" });

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add phantom-secrets-mcp -- npx -y phantom-secrets-mcp

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "phantom-secrets-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "phantom-secrets-mcp"
      ]
    }
  }
}

~/.codex/config.toml

[mcp_servers.phantom-secrets-mcp]
command = "npx"
args = ["-y", "phantom-secrets-mcp"]

.cursor/mcp.json

{
  "mcpServers": {
    "phantom-secrets-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "phantom-secrets-mcp"
      ]
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "phantom-secrets-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "phantom-secrets-mcp"
      ]
    }
  }
}

Alternatives to Phantom Secrets

same job, measured the same way

Zn Gate

by usezn

The local security layer for coding agents: secret redaction, injection checks and an MCP proxy.

1 483 installs/wk local only

HOL Guard

by hashgraph-online

Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.

17 856 installs/wk local only

Stashbase

by stashbase

Secrets for developers and agents—secure context and workflows without exposing secret values.

answering

Defenter Proxy

by defenter-ai

Real-time semantic security for AI coding agents and MCP tools

76 installs/wk local only

MCP Audit Server

by joepangallo

Thin MCP and CLI proxy for AI agent and MCP security auditing via a hosted backend

66 installs/wk local only

Krita Codex MCP

by cyyprezz

Control Krita through a secure local MCP server and authenticated Windows bridge.

400 installs/wk local only

Holster MCP

by nautaai

Local-first secret scanning, rotation, vault, and audit-log tools for AI agents.

102 installs/wk local only

Switchboard

by wkoverfield

One firewall and password manager for all your AI coding agents' MCP servers and secrets.

77 installs/wk local only

Phantom Secrets — questions

Answers built from our own checks of this server.

Why is there no uptime for Phantom Secrets?

Phantom Secrets runs on your own machine over stdio — there is no network address to reach, so uptime cannot be measured for it by anyone. What can be measured is adoption: the npm package phantom-secrets-mcp was installed 95 times last week.

How do I connect Phantom Secrets?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It runs locally, so the command pulls phantom-secrets-mcp straight from npm; nothing to host, nothing to sign up for.

How many people use Phantom Secrets?

The npm package phantom-secrets-mcp was installed 95 times in the last week. Week over week that is +506%. We show installs rather than GitHub stars on purpose: a star is a bookmark, an install is someone actually running it.

Is Phantom Secrets open source?

Yes — it is published under the MIT licence, written in Rust, 20 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.