The usual arrangement gives an agent the raw key and hopes. Here the key never crosses the boundary — the agent names a capability and an action, Janee attaches the credential and returns only the response. That also fixes the operational mess underneath: one config serves every client, so rotating a key is one edit rather than a hunt through settings files. Exec mode is the part worth noticing, because CLI tools want credentials as environment variables and this maps them in without the agent ever reading them. Everything is logged, and a session can be revoked while it is running.
A TypeScript MCP server that sits between your agents and the APIs they need: keys stay encrypted on your machine, the agent asks for an action, and Janee makes the request with the real credential attached.
- janee_execute — an HTTP call made on the agent's behalf, with the credential injected and never returned
- janee_exec — a CLI tool run with credentials mapped into its environment, restricted to commands you allowlisted
- janee_list_services — the services an agent can reach, without exposing what is behind them
- explain_access — why a request was allowed or refused, in terms you can act on
- manage_credential and reload_config, for changing a key or a policy without restarting everything
- Per-capability allow and deny rules, so a capability can be read-only against one API and full against another
- Session TTLs with instant revocation, and an audit trail carrying timestamp, method, path and status for every request
- Auth types beyond bearer tokens: GitHub App short-lived tokens instead of static PATs, Twitter OAuth 1.0a signed per request, and AWS SigV4 signing
- Git push and pull that just works once the credentials include a GitHub token
- One config that every MCP client shares — Claude Desktop, Cursor, OpenClaw and others
Your own API keys, stored encrypted under a local directory Janee creates — nothing is sent to a cloud. Installed globally from npm as @true-and-useful/janee, initialised once, then services added interactively or by editing the config file. JANEE_CONFIG points at a different secrets file if you want one.
One command — npm install -g @true-and-useful/janee