agent-keys

MCP server that lets AI agents autonomously acquire and manage API keys.

The Problem

AI agents frequently need API keys to accomplish tasks — sending emails, making calls, running models, storing data. Today this requires a human to manually create accounts, navigate dashboards, and paste keys into configs. agent-keys gives agents a structured, secure interface to discover services, get provisioning instructions, store retrieved keys, verify they work, and export them as environment variables — all without human intervention after initial setup.

Quick Start

Via npx (no install required)

npx @gonzih/agent-keys

MCP Configuration

Add to your MCP config file (e.g. ~/.claude/claude_desktop_config.json or ~/.config/claude-code/config.json):

{
  "mcpServers": {
    "agent-keys": {
      "command": "npx",
      "args": ["@gonzih/agent-keys"],
      "env": {
        "AGENT_KEYS_SECRET": "your-strong-encryption-secret"
      }
    }
  }
}

Claude Code Config

Add to your Claude Code settings:

{
  "mcpServers": {
    "agent-keys": {
      "command": "npx",
      "args": ["@gonzih/agent-keys"],
      "env": {
        "AGENT_KEYS_SECRET": "your-strong-encryption-secret"
      }
    }
  }
}

Tools

list_services

List all 26 supported services with their category, description, signup URL, and whether a key is stored.

Input: none

Output:

[
  {
    "name": "openai",
    "displayName": "OpenAI",
    "category": "ai",
    "description": "AI research company providing GPT-4, DALL-E, Whisper, and embeddings APIs.",
    "signupUrl": "https://platform.openai.com/signup",
    "has_key": true,
    "freetier": "$5 free credit for new accounts (limited time)",
    "envVarName": "OPENAI_API_KEY"
  }
]

---

get_api_key

Retrieve a stored API key. Returns the key if found, or provisioning guidance if not.

Input:

{ "service": "openai" }

Output (found):

{
  "found": true,
  "service": "openai",
  "key": "sk-proj-...",
  "stored_at": "2024-01-15T10:30:00.000Z",
  "envVarName": "OPENAI_API_KEY"
}

Output (not found):

{
  "found": false,
  "service": "openai",
  "message": "No API key stored for OpenAI. Use provision_api_key to get instructions.",
  "signupUrl": "https://platform.openai.com/signup"
}

---

store_api_key

Store an API key in the encrypted vault.

Input:

{
  "service": "openai",
  "key": "sk-proj-...",
  "metadata": { "org": "my-org", "created_by": "agent" }
}

Output:

{
  "success": true,
  "service": "openai",
  "displayName": "OpenAI",
  "message": "API key for OpenAI stored successfully.",
  "envVarName": "OPENAI_API_KEY"
}

---

check_api_key

Verify a stored key is still valid by calling the service's test endpoint.

Input:

{ "service": "openai" }

Output:

{
  "valid": true,
  "service": "openai",
  "displayName": "OpenAI",
  "status": 200,
  "message": "API key for OpenAI is valid."
}

Services with test endpoints: openai, sendgrid, stripe, github, groq, together-ai, elevenlabs, deepgram, replicate, brave-search, serper, tavily.

---

provision_api_key

Get step-by-step instructions and the direct signup URL for acquiring an API key.

Input:

{ "service": "groq" }

Output:

{
  "service": "groq",
  "displayName": "Groq",
  "signupUrl": "https://console.groq.com/login",
  "steps": [
    "Go to https://console.groq.com/login",
    "Create a free account or sign in",
    "Navigate to https://console.groq.com/keys",
    "Click 'Create API Key'",
    "Give it a name and click 'Submit'",
    "Copy the generated API key immediately (shown only once)",
    "Store it using store_api_key with service 'groq'"
  ],
  "freetier": "Free tier with generous rate limits"
}

---

remove_api_key

Delete a key from the vault.

Input:

{ "service": "openai" }

Output:

{
  "success": true,
  "service": "openai",
  "message": "API key for OpenAI removed from vault."
}

---

export_env

Generate shell export statements for stored keys.

Input:

{ "services": ["openai", "anthropic"] }

Or omit services to export all stored keys.

Output:

{
  "exports": [
    "export OPENAI_API_KEY=\"sk-proj-...\"",
    "export ANTHROPIC_API_KEY=\"sk-ant-...\""
  ],
  "shell": "export OPENAI_API_KEY=\"sk-proj-...\"\nexport ANTHROPIC_API_KEY=\"sk-ant-...\"",
  "count": 2
}

---

Supported Services

AI (5 services)

Name	Display Name	Free Tier	Env Var
openai	OpenAI	$5 credit (new accounts)	OPENAI_API_KEY
anthropic	Anthropic	Free tier with rate limits	ANTHROPIC_API_KEY
replicate	Replicate	Pay-per-use, free community models	REPLICATE_API_TOKEN
together-ai	Together AI	$25 free credit	TOGETHER_API_KEY
groq	Groq	Free tier, generous limits	GROQ_API_KEY

Communication (6 services)

Name	Display Name	Free Tier	Env Var(s)
twilio	Twilio	$15 trial credit	TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN
sendgrid	SendGrid	100 emails/day forever	SENDGRID_API_KEY
mailgun	Mailgun	100 emails/day, 3 months	MAILGUN_API_KEY
postmark	Postmark	100 emails/month forever	POSTMARK_API_TOKEN
vonage	Vonage (Nexmo)	$2 trial credit	VONAGE_API_KEY, VONAGE_API_SECRET
telnyx	Telnyx	$1 credit on signup	TELNYX_API_KEY

Voice (3 services)

Name	Display Name	Free Tier	Env Var
elevenlabs	ElevenLabs	10,000 chars/month	ELEVENLABS_API_KEY
deepgram	Deepgram	$200 free credit	DEEPGRAM_API_KEY
assemblyai	AssemblyAI	$50 free credit	ASSEMBLYAI_API_KEY

Infrastructure (8 services)

Name	Display Name	Free Tier	Env Var
stripe	Stripe	No monthly fee	STRIPE_SECRET_KEY
github	GitHub	Free for personal use	GITHUB_TOKEN
cloudflare	Cloudflare	Free plan available	CLOUDFLARE_API_TOKEN
vercel	Vercel	Hobby plan free	VERCEL_TOKEN
railway	Railway	$5 credit/month	RAILWAY_TOKEN
supabase	Supabase	2 free projects	SUPABASE_ANON_KEY
planetscale	PlanetScale	5GB free storage	PLANETSCALE_SERVICE_TOKEN
upstash	Upstash	10,000 commands/day	UPSTASH_REDIS_REST_TOKEN

Data (4 services)

Name	Display Name	Free Tier	Env Var
serper	Serper	2,500 free searches	SERPER_API_KEY
brave-search	Brave Search	2,000 queries/month	BRAVE_API_KEY
tavily	Tavily	1,000 calls/month	TAVILY_API_KEY
firecrawl	Firecrawl	500 credits on signup	FIRECRAWL_API_KEY

Adding a New Service

Edit src/registry.ts and add a new object to the registry array:

{
  name: 'my-service',           // slug used in tool calls
  displayName: 'My Service',    // human-readable name
  category: 'ai',               // 'communication' | 'ai' | 'voice' | 'infrastructure' | 'data'
  description: 'What it does.',
  signupUrl: 'https://myservice.com/signup',
  docsUrl: 'https://docs.myservice.com/api',
  envVarName: 'MY_SERVICE_API_KEY',
  freetier: 'Description of free tier',
  programmatic: false,
  provisioningSteps: [
    'Go to https://myservice.com/signup',
    'Create an account',
    'Navigate to API Keys',
    'Click Create Key',
    'Copy the key',
    'Store it using store_api_key with service "my-service"',
  ],
  testEndpoint: {               // optional
    url: 'https://api.myservice.com/v1/me',
    method: 'GET',
    headers: (key: string) => ({ Authorization: `Bearer ${key}` }),
    successStatus: 200,
  },
}

Then run npm run build.

Security

• Encryption: AES-256-GCM with scrypt key derivation (N=16384, r=8, p=1)
• Per-write randomness: Each vault write uses a fresh 16-byte salt and 16-byte IV
• Auth tag: GCM auth tag prevents undetected tampering
• Plaintext fallback: If AGENT_KEYS_SECRET is not set, keys are stored unencrypted with a warning
• Vault location: ~/.agent-keys/vault.json by default; override with AGENT_KEYS_VAULT
• Secret management: Never commit AGENT_KEYS_SECRET to source control; use env vars or a secrets manager

Development

# Install dependencies
npm install

# Build TypeScript
npm run build

# Run directly with tsx (no build step)
npm run dev

License

MIT