Credential Broker runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 7 Nov 2026.
Local-first credential broker: agents use gated APIs through scoped, audited requests, never keys.
What the code does
We read the source, 50 min ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const child = spawn(process.execPath, [entry], {
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add credential-broker-mcp -e 'BROKER_AGENT_ID=<BROKER_AGENT_ID>' -- npx -y @sarutobi-sasuke/credential-broker-mcp{
"mcpServers": {
"credential-broker-mcp": {
"command": "npx",
"args": [
"-y",
"@sarutobi-sasuke/credential-broker-mcp"
],
"env": {
"BROKER_AGENT_ID": "<BROKER_AGENT_ID>"
}
}
}
}[mcp_servers.credential-broker-mcp]
command = "npx"
args = ["-y", "@sarutobi-sasuke/credential-broker-mcp"]
env = { BROKER_AGENT_ID = "<BROKER_AGENT_ID>" }{
"mcpServers": {
"credential-broker-mcp": {
"command": "npx",
"args": [
"-y",
"@sarutobi-sasuke/credential-broker-mcp"
],
"env": {
"BROKER_AGENT_ID": "<BROKER_AGENT_ID>"
}
}
}
}{
"servers": {
"credential-broker-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@sarutobi-sasuke/credential-broker-mcp"
],
"env": {
"BROKER_AGENT_ID": "<BROKER_AGENT_ID>"
}
}
}
}Put your own value in place of
<BROKER_AGENT_ID> (Which agent identity this process is. Must be provisioned in the policy file).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
BROKER_POLICY_FILE (Path to the policy YAML (version 2). Defaults to config/broker.yaml), BROKER_AUDIT_FILE (Path to the content-free audit log. Defaults to data/audit.jsonl), BROKER_APPROVALS_FILE (Path to the approvals file. Defaults to config/approvals.json), BROKER_HOT_RELOAD (Set to 1 to pick up key manager changes without a restart. Off by default), BROKER_ALLOW_KEY_REQUESTS (Set to 1 to let this agent ask the operator for a key through the key manager. Off by default).
Alternatives to Credential Broker
same job, measured the same wayAI agents use your API keys, SSH keys and wallets through a local broker, never holding them
Local encrypted secret broker for AI agents: request keys by name, approve each use over MCP.
Local credential broker: agents call APIs, SSH and DBs via scoped presets; secrets stay in keychain.
credential leases, never raw keys — scoped, expiring secret leases for agents; the agent gets a
Credential broker for AI agents: scoped, revocable API access with policy enforcement and audit.
Local MCP broker: agents call credentials through a daemon without seeing secrets.
Keep credentials out of AI coding agents with local approvals, scoped injection, and audit trails.
ProphetKey MCP bridge - encrypted local-first API key vault for AI agents, keys never exposed
Credential Broker — questions
Answers built from our own checks of this server.