Local encrypted vault MCP server. AES-256-GCM + Argon2id. Resolves {{PLACEHOLDER}} secrets at runtime so LLMs never see real API keys. Works with Claude Desktop, Cursor, Continue.dev, Cline, Open WebUI.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add enigmagent --env VAULT_PASSWORD='<VAULT_PASSWORD>' --env VAULT_PATH='<VAULT_PATH>' -- npx -y enigmagent-mcp~/.codex/config.toml
[mcp_servers.enigmagent]
command = "npx"
args = ["-y", "enigmagent-mcp"]
env = { VAULT_PASSWORD = "<VAULT_PASSWORD>", VAULT_PATH = "<VAULT_PATH>" }
# codex mcp add enigmagent --env VAULT_PASSWORD='<VAULT_PASSWORD>' --env VAULT_PATH='<VAULT_PATH>' -- npx -y enigmagent-mcp~/.cursor/mcp.json
{
"mcpServers": {
"enigmagent": {
"command": "npx",
"args": [
"-y",
"enigmagent-mcp"
],
"env": {
"VAULT_PASSWORD": "<VAULT_PASSWORD>",
"VAULT_PATH": "<VAULT_PATH>"
}
}
}
}.vscode/mcp.json
{
"servers": {
"enigmagent": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"enigmagent-mcp"
],
"env": {
"VAULT_PASSWORD": "<VAULT_PASSWORD>",
"VAULT_PATH": "<VAULT_PATH>"
}
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"enigmagent": {
"command": "npx",
"args": [
"-y",
"enigmagent-mcp"
],
"env": {
"VAULT_PASSWORD": "<VAULT_PASSWORD>",
"VAULT_PATH": "<VAULT_PATH>"
}
}
}
}claude_desktop_config.json
{
"mcpServers": {
"enigmagent": {
"command": "npx",
"args": [
"-y",
"enigmagent-mcp"
],
"env": {
"VAULT_PASSWORD": "<VAULT_PASSWORD>",
"VAULT_PATH": "<VAULT_PATH>"
}
}
}
}.trae/mcp.json
{
"mcpServers": {
"enigmagent": {
"command": "npx",
"args": [
"-y",
"enigmagent-mcp"
],
"env": {
"VAULT_PASSWORD": "<VAULT_PASSWORD>",
"VAULT_PATH": "<VAULT_PATH>"
}
}
}
}Environment variables
VAULT_PASSWORDVAULT_PATH
Replace the placeholders with your own credentials and keep them out of version control.