Two controls do the work: injection means the value exists only in the child process's environment, and the policy file denies by default so only the commands you named are runnable. The stated limit is worth reading — output sanitisation is exact string matching, so a secret that appears base64-encoded or partially in the output will not be caught. Note also that the master password lives in the MCP client's config as an environment variable.
A local secret vault with an MCP server attached. The agent never receives plaintext values: it asks secretctl to run a command, secretctl injects the secrets as environment variables for that process, and the output is scrubbed before it goes back. Everything stays on your machine — one binary, a SQLite vault, no service to sign up for.
- `secret_list` lists keys with metadata and no values; `secret_exists` checks one
- `secret_get_masked` returns a masked value such as ****WXYZ, enough to confirm which credential is stored
- `secret_run` executes a command with secrets injected as environment variables, and sanitises the output
- `secret_run_with_bindings` does the same with predefined environment bindings
- `secret_list_fields` and `secret_get_field` handle multi-field secrets, returning only the non-sensitive fields
- A policy file at `~/.secretctl/mcp-policy.yaml` sets `default_action: deny` and an explicit allowed-commands list
- Values are encrypted at rest with AES-256-GCM under an Argon2id-derived key, and the audit log is HMAC-chained so tampering shows
A single binary — build from source with Go 1.24+, or download a release for Linux, macOS or Windows. Initialise the vault with `secretctl init` and a master password of at least 8 characters. The MCP server needs that password in `SECRETCTL_PASSWORD` at launch: `secretctl mcp-server`. On macOS an unsigned download needs `xattr -d com.apple.quarantine`.
One command plus a key — brew install forest6511/tap/secretctl, then supply credentials