SecureCode
FreeMaintainedSecrets vault for Claude Code. Encrypt API keys, tokens and passwords with AES-256. Full audit logs, MCP access rules, and zero-knowledge mode. Secrets never ap
About
Secrets vault for Claude Code. Encrypt API keys, tokens and passwords with AES-256. Full audit logs, MCP access rules, and zero-knowledge mode. Secrets never appear in chat.
README
MCP Server for SecureCodeHQ. Lets Claude Code access your secrets securely without ever seeing them.
Quick Start
claude mcp add securecode -- npx -y @securecode/mcp-server
Then tell Claude Code:
Set up SecureCode in this project
The onboard tool walks you through account creation, secret import, and configuration. Takes about 2 minutes.
What It Does
Your secrets (API keys, tokens, passwords) are encrypted with AES-256 and stored in SecureCode. Claude Code accesses them via MCP, but the actual values never appear in the chat.
When Claude reads a secret, the value is written to a local file on your machine. The AI gets the file path but never sees the raw value. This is inject mode, the default.
Tools
| Tool | What it does |
|---|---|
onboard |
Guided setup: signup, import, API key, config, SDK |
get-secret |
Get a secret (injected to file by default, reveal: true to show to AI) |
list-secrets |
List all secrets with tags and expiry status |
create-secret |
Create a new secret |
update-secret |
Update value, description, or tags |
delete-secret |
Delete a secret |
renew-secret |
Renew expired secrets or change TTL |
import-env |
Import .env via secure web window (values never pass through AI) |
export-env |
Export secrets as .env or CSV |
get-status |
Check plan, usage, and MCP server version |
wake-session |
Unlock session with optional scope and auto-sleep timer |
sleep-session |
Lock session and clean injected files |
session-status |
Check session state and time remaining |
byebye |
Lock session + clean all secrets from disk |
get-active-rules |
List active MCP access rules (read-only) |
security-check |
Post-setup security hardening checks |
help |
Docs: tools, SDK, sessions, rules, troubleshooting |
MCP Access Rules
Control how AI agents access your secrets with tag-based policies. Created from the dashboard, enforced server-side.
| Action | Effect |
|---|---|
| Block Always | Secret only accessible from the dashboard |
| Require Confirmation | Agent must acknowledge before accessing |
| Require Session | Requires active session (wake-session) |
| Block Models | Only allows specific AI models |
| Notify | Sends email on access (non-blocking) |
Session Lock
You: "Wake my session for acme staging"
Claude: Session unlocked. Only acme/staging secrets accessible.
You: "byebye"
Claude: Session locked & secrets cleaned from disk.
Sessions auto-sleep after configurable inactivity (default: 2 hours).
How It Works
- Secret values are written to a local file, the AI never sees them (inject mode)
- Explicit
reveal: truereturns value to AI (audited) - Injected files are removed on sleep, byebye, or process exit
- Multiple Claude Code instances don't collide (hash based on API key + PID)
- Encrypted with AES-256-GCM using envelope encryption (Cloud KMS)
- Every access is logged with AI model, IP, machine identity, and timestamp
- Runs locally via stdio transport, secrets never pass through third parties
- Device approval required on first use from each machine
SDK
The companion SDK lets your app load secrets at runtime:
npm install @securecode/sdk
import { loadEnv } from '@securecode/sdk';
await loadEnv(); // all secrets loaded into process.env
Links
- Website: https://securecodehq.com
- npm: https://www.npmjs.com/package/@securecode/mcp-server
- SDK: https://www.npmjs.com/package/@securecode/sdk
Requirements
- Node.js >= 18
- A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)
License
MIT
Install SecureCode in Claude Desktop, Claude Code & Cursor
unyly install securecodeInstalls into Claude Desktop, Claude Code, Cursor & VS Code — handles npx, uvx and build-from-source repos for you.
First time? Get the CLI: curl -fsSL https://unyly.org/install | sh
Or configure manually
Run in your terminal:
claude mcp add securecode --env SECURECODE_API_KEY="" -- npx -y @securecode/mcp-serverStep-by-step: how to install SecureCode
FAQ
Is SecureCode MCP free?
Yes, SecureCode MCP is free — one-click install via Unyly at no cost.
Does SecureCode need an API key?
Yes, it requires environment variables: SECURECODE_API_KEY. Unyly injects them into the config during install.
Is SecureCode hosted or self-hosted?
Self-hosted: the server runs locally on your machine via the install command above.
How do I install SecureCode in Claude Desktop, Claude Code or Cursor?
Open SecureCode on unyly.org, pick your client tab (Claude Desktop, Claude Code, Cursor) and press Install — the config is generated automatically, no JSON editing.
Changes
Versions and requested access over time.
- New version published
- New version published
Related MCPs
Gmail
Read, send and search emails from Claude
by GoogleSlack
Send, search and summarize Slack messages
by SlackRunbear
No-code MCP client for team chat platforms, such as Slack, Microsoft Teams, and Discord.
Discord Server
A community discord server dedicated to MCP by [Frank Fiegel](https://github.com/punkpeye)
Klavis AI
Open Source MCP Infra. Hosted MCP servers and MCP clients on Slack and Discord.
Work90210/APIFold
Turn any REST API into a hosted MCP server. 18 free public servers (GitHub, Stripe, Slack, OpenAI, Notion, and more) — no setup required, bring your own API key
by Work90210arikusi/deepseek-mcp-server
MCP server for DeepSeek AI with chat, reasoning, multi-turn sessions, function calling, thinking mode, and cost tracking.
by arikusihashgraph-online/hashnet-mcp-js
MCP server for the Registry Broker. Discover, register, and chat with AI agents on the Hashgraph network.
by hashgraph-onlineprofullstack/mcp-server
A comprehensive MCP server aggregating 20+ tools including SEO optimization, document conversion, domain lookup, email validation, QR generation, weather data,
by profullstackWayStation-ai/mcp
Seamlessly and securely connect Claude Desktop and other MCP hosts to your favorite apps (Notion, Slack, Monday, Airtable, etc.). Takes less than 90 secs.
by waystation-aiCompare SecureCode with
Not sure what to pick?
Find your stack in 60 seconds
Author?
Embed badge for your README
Browse similar
All communication MCPs