check_keypair
Check if a key pair exists for the given key ID
LABSCO SUMMARY
Private key material never leaves the process.
The tools return public keys and signatures as base64 and nothing else, so an agent can prove something cryptographically without ever holding the key it used. Encryption at rest is where the responsibility lands on you: it is off until ENCRYPT_STORE is set and a key is supplied.
What it is
A local key manager over MCP. It generates signing keypairs scoped to a key id, stores them in a file-based keystore, signs base64 payloads without exposing private key material, rotates keys while preserving the algorithm, and deletes them with an optional secure wipe.
What you get
- generate_key creates and persists a keypair for a key id, in the algorithm you choose
- sign_message signs a base64-encoded message with the stored private key and returns the signature as base64
- rotate_key replaces the pair while keeping the existing algorithm
- delete_key removes a pair, optionally overwriting it with random data first
- check_keypair, get_key_info, list_keys and list_algorithms cover inspection
- Algorithms: Ed25519, ECDSA secp256k1 for Ethereum and Bitcoin flows, ECDSA P-256 for ES256 and WebAuthn, ECDSA P-384
- Keys can be encrypted at rest with AES-256-GCM
Requirements
The npm package local-kms-mcp-server, run with npx -y or installed globally. Node.js 24.0.0 or newer. STORE_PATH is the directory holding the key files and defaults to ./keys. ENCRYPT_STORE set to true turns on encryption at rest, which then requires STORE_ENCRYPTION_KEY, a base64-encoded 32-byte value. TRANSPORT defaults to stdio; set it to http with PORT to expose POST /mcp on a local endpoint. Pass these through the client's env block rather than a .env file so startup is deterministic.
Setup effort
One command — npx -y local-kms-mcp-server
USE CASES
01
Giving each agent a distinct identity
One keypair per key id, so tasks and agents can be told apart by what they signed.
02
Signing a challenge during an auth handshake
Pass a base64 payload, get a base64 signature back, with the private key never leaving the process.
03
Rotating a key without changing the algorithm
The replacement keeps the same curve, so verifiers downstream do not need reconfiguring.
04
Retiring an identity for good
Delete the pair, with an optional overwrite so the material is not just unlinked.
05
Picking the right curve for the ecosystem
Ed25519 for general signing, secp256k1 for Web3, P-256 for WebAuthn and cloud KMS compatibility.
8 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
delete_key
Delete a key pair from the keystore
generate_key
Generate and store a new key pair for the given key ID
get_key_info
Get the key pair information for the given key ID
list_algorithms
List all supported signing algorithms
list_keys
List all key pairs in the key store
rotate_key
Rotate the key pair for the given key ID, preserving the existing algorithm
sign_message
Sign a base64-encoded message with the stored private key
BEFORE YOU INSTALL
What to know first
Tools you get
8 tools when we connected.
Requires
- npx on PATH
- Node.js >=24.0.0
CONTEXT COST
Light Standing cost
Rated by the size of the 8 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y local-kms-mcp-serverMCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"local-kms": {
"command": "npx",
"args": [
"-y",
"local-kms-mcp-server"
],
"env": {
"STORE_PATH": "/Users/<YOUR_USERNAME>/.local-kms",
"ENCRYPT_STORE": "true",
"STORE_ENCRYPTION_KEY": "<YOUR_STORE_ENCRYPTION_KEY>"
}
}
}
}/Users/<YOUR_USERNAME>/.local-kms is a directory for the key files (leave STORE_PATH out and it uses ./keys). With ENCRYPT_STORE set to true the server needs STORE_ENCRYPTION_KEY, a base64-encoded 32-byte key you generate yourself: node -e "console.log(require('node:crypto').randomBytes(32).toString('base64'))". Remove both lines to keep the key files unencrypted, which is the default.
Any MCP client — HTTP
Start it in HTTP mode and keep it running
ANY MCP CLIENT — HTTP · TERMINAL
TRANSPORT=http PORT=8080 npx local-kms-mcp-serverThen add this endpoint to your client
Add it as a Streamable HTTP server in any client that supports HTTP MCP servers; the server answers POST requests on /mcp. If you change PORT, change the URL to match. HTTP mode adds no authentication or TLS, so keep it on your own machine.
ANY MCP CLIENT — HTTP · URL
http://localhost:8080/mcp
