Where is the source code for Secretcarousel?
The source code is linked from the repository URL on this page.
SecretCarousel MCP Server
@Tyga.Cloud Ltd
基本情報
SecretCarousel MCP Server について
The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
SecretCarousel MCP Server の設定
以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。
{
"mcpServers": {
"secretcarousel": {
"command": "npx",
"args": [
"secretcarousel",
"mcp-serve"
],
"env": {
"SC_API_KEY": "sc_your_api_key_here"
}
}
}
}SecretCarousel MCP Server のツール
20THE agent-to-agent handoff. Mint a ONE-TIME, scoped, expiring claim token that hands a secret to another tenant/agent — even a different project or company. The receiving agent redeems it exactly once, the token burns, and the whole exchange is audit-logged. No plain-text value ever crosses the boundary. Requires a paid plan.
Redeem a claim token you were handed by another agent. One-time use — the token burns on redemption and the access is logged. Returns the secret id and name; retrieve the value with sc_get_secret.
List claim tokens you have minted, with their status (pending, claimed, expired) and target tenant.
Store a secret encrypted (AES-256-GCM). Returns an ID only — the value is NOT echoed. Reference the secret by id from now on; never write the plain-text value into code, logs, or chat.
Retrieve a secret by ID (decrypted). The read is access-logged. Fetch the value only at the moment of use so it never lingers in the transcript.
List secrets (ids + names + metadata, NO values). Filter by type or environment.
Search secret names, descriptions, tags, and categories. Returns ids + names, NO values.
Update a secret's value and/or description by ID. The rotation is audit-logged.
Permanently delete a secret by ID. Audit-logged.
Rotate a secret now (generate a fresh value). Gives a leaked key a short half-life. Audit-logged.
Set a scheduled rotation policy on a secret (e.g. every 30d) with an optional pre-expiry alert.
Create a time-limited, view-limited share link for a secret (e.g. hand to a human). Optional password protection. Prefer sc_mint_claim_token for agent-to-agent handoff. Returns a ready-to-use `redeem` block — give the recipient redeem.url and tell them to POST it (no auth). Do NOT hand-build the URL from the raw token: the redeem path is POST /api/v1/shares/access/{token} (POST-only, and the /api/v1 prefix is required — GET or a shorter path 404s).
List active share links with their expiry and remaining views. Set includeRevoked=true to also return revoked shares (otherwise they are hidden) — useful as an audit trail of what was un-shared.
Show one share link's live status and usage counters — status (active/revoked/expired/exhausted), currentUses/maxUses, remainingUses, and revokedAt/reason if revoked. Use this to answer the key incident question: has this share been read yet? (currentUses:0 means the secret was never retrieved.)
Break-glass un-share: immediately revoke an active share link. After revocation the redeem URL returns 410 Gone (code SHARE_NO_LONGER_AVAILABLE) and the secret can no longer be retrieved through that link. This is the emergency path — use it the moment a shared credential needs to be killed. Optional reason is recorded for the audit trail.
Read the audit trail — every secret read/write, rotation, share, and claim is logged. Filter by action or resource type.
Report a bug or request a feature for SecretCarousel itself. Use this whenever the product misbehaves, a command is confusing, or something is missing — the report lands on the SecretCarousel team board. Available on every plan (including trial). Set type="bug" for defects (severity P0-P3) or type="feature" for requests (priority P0-P3).
List the bugs and feature requests you have filed for SecretCarousel, newest first, with their current status. Optionally filter by type.
Read the comment thread on a piece of feedback you filed (the SecretCarousel team may have replied with questions or a status update).
Add a follow-up comment to feedback you filed — attach extra repro detail, logs, or confirm whether a fix worked.
概要
What is Secretcarousel?
The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
How to use Secretcarousel?
The README includes setup instructions such as npx secretcarousel signup my-project --local.
Key features of Secretcarousel
- Claim tokens — hand a secret to another agent/tenant via a one-time, scoped, expiring, audited token
- Rotation — rotate now or on a schedule, with email alerts
- Sharing — time- and view-limited links for humans
- Environments — export as .env, promote secrets between environments
- Scoped API keys — read/write/admin per key, project-scoped
Use cases of Secretcarousel
- Connect an MCP-compatible client to this repository's service.
- Review the README-backed setup before enabling it in production.
よくある質問
Does Secretcarousel include a standard MCP config?
If the README contains a parseable MCP configuration block, it is shown in the Config tab.
「開発者ツール」の他のコンテンツ
OSIR Domain Name MCP Server
OsirRemote MCP server from OSIR, an ICANN-accredited registrar: 105 tools and 11 prompts to search, register, renew, transfer, and manage domains, DNS, VPS, email, and websites from Claude, ChatGPT, Cursor, or any MCP client
FARPY
mangomunchrVerified distributed compute for humans, applications, and agents. Submit Blender, Octane, and video workloads, route them across qualified GPUs, track asynchronous execution, download finished artifacts, and verify FARP
1
Termany
thinkany-aiAgent-Native Terminal
174
Rams
HSLA0001 Inc.Design review for UI code, inside your agent. quick_review checks the files you just changed in about ten seconds. review_files returns a 0-100 score and patches. verify_fixes confirms the fixes landed, free. review_url
M
MeroFoundry
MERO Consulting IncMeroFoundry is a remote MCP server available at https://platform.merofoundry.com/mcp.
コメント