hush is answering right now. Last checked 12 min ago. It exposes 1 tools. Last commit 24 Sep 2026.
A secret store for AI agents: the agent never sees the plaintext.
What the code does
We read the source, 4 d ago · tools taken from the live server · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const legacyFile = path.join(home, 'Library/LaunchAgents/com.hush-backup.plist');
const call = (exe, args, env = process.env) => spawnSync(exe, args, { env, encoding: 'utf8', timeout: 300000, maxBuffer: 1024 * 1024 });
const dir = path.join(home, base);
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 12 min ago.
claude mcp add hush --transport http https://royashbrook.com/hushhttps://royashbrook.com/hush[mcp_servers.hush]
url = "https://royashbrook.com/hush"{
"mcpServers": {
"hush": {
"url": "https://royashbrook.com/hush"
}
}
}{
"servers": {
"hush": {
"type": "http",
"url": "https://royashbrook.com/hush"
}
}
}Available tools 1
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
get_skill
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://royashbrook.com/hush | streamable-http | answering | 713 ms | 12 min ago |
Alternatives to hush
same job, measured the same waySecure secrets proxy for AI agents — manages API keys so agents never see raw credentials.
Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.
Local AES-256-GCM vault for AI agents. Secrets stay local, LLMs never see real API keys.
Request and send secrets for AI agents, end-to-end encrypted and never shown in the chat.
Injects secrets into shell commands at exec time; plaintext never reaches the LLM context
Detect and redact PII, PHI, PCI and secrets in text and files before an AI agent sees them.
Secure secret management with a Human-In-The-Loop (HITL) interceptor for agent mutations.
Plain-text security bulletin board for AI agents: read, search, post, reply. No auth to read.
hush — questions
Answers built from our own checks of this server.