Where is the source code for Secretcarousel?
The source code is linked from the repository URL on this page.
SecretCarousel MCP Server
@Tyga.Cloud Ltd
Basic information
About SecretCarousel MCP Server
The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
SecretCarousel MCP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"secretcarousel": {
"command": "npx",
"args": [
"secretcarousel",
"mcp-serve"
],
"env": {
"SC_API_KEY": "sc_your_api_key_here"
}
}
}
}SecretCarousel MCP Server tools
20THE agent-to-agent handoff. Mint a ONE-TIME, scoped, expiring claim token that hands a secret to another tenant/agent — even a different project or company. The receiving agent redeems it exactly once, the token burns, and the whole exchange is audit-logged. No plain-text value ever crosses the boundary. Requires a paid plan.
Redeem a claim token you were handed by another agent. One-time use — the token burns on redemption and the access is logged. Returns the secret id and name; retrieve the value with sc_get_secret.
List claim tokens you have minted, with their status (pending, claimed, expired) and target tenant.
Store a secret encrypted (AES-256-GCM). Returns an ID only — the value is NOT echoed. Reference the secret by id from now on; never write the plain-text value into code, logs, or chat.
Retrieve a secret by ID (decrypted). The read is access-logged. Fetch the value only at the moment of use so it never lingers in the transcript.
List secrets (ids + names + metadata, NO values). Filter by type or environment.
Search secret names, descriptions, tags, and categories. Returns ids + names, NO values.
Update a secret's value and/or description by ID. The rotation is audit-logged.
Permanently delete a secret by ID. Audit-logged.
Rotate a secret now (generate a fresh value). Gives a leaked key a short half-life. Audit-logged.
Set a scheduled rotation policy on a secret (e.g. every 30d) with an optional pre-expiry alert.
Create a time-limited, view-limited share link for a secret (e.g. hand to a human). Optional password protection. Prefer sc_mint_claim_token for agent-to-agent handoff. Returns a ready-to-use `redeem` block — give the recipient redeem.url and tell them to POST it (no auth). Do NOT hand-build the URL from the raw token: the redeem path is POST /api/v1/shares/access/{token} (POST-only, and the /api/v1 prefix is required — GET or a shorter path 404s).
List active share links with their expiry and remaining views. Set includeRevoked=true to also return revoked shares (otherwise they are hidden) — useful as an audit trail of what was un-shared.
Show one share link's live status and usage counters — status (active/revoked/expired/exhausted), currentUses/maxUses, remainingUses, and revokedAt/reason if revoked. Use this to answer the key incident question: has this share been read yet? (currentUses:0 means the secret was never retrieved.)
Break-glass un-share: immediately revoke an active share link. After revocation the redeem URL returns 410 Gone (code SHARE_NO_LONGER_AVAILABLE) and the secret can no longer be retrieved through that link. This is the emergency path — use it the moment a shared credential needs to be killed. Optional reason is recorded for the audit trail.
Read the audit trail — every secret read/write, rotation, share, and claim is logged. Filter by action or resource type.
Report a bug or request a feature for SecretCarousel itself. Use this whenever the product misbehaves, a command is confusing, or something is missing — the report lands on the SecretCarousel team board. Available on every plan (including trial). Set type="bug" for defects (severity P0-P3) or type="feature" for requests (priority P0-P3).
List the bugs and feature requests you have filed for SecretCarousel, newest first, with their current status. Optionally filter by type.
Read the comment thread on a piece of feedback you filed (the SecretCarousel team may have replied with questions or a status update).
Add a follow-up comment to feedback you filed — attach extra repro detail, logs, or confirm whether a fix worked.
Overview
What is Secretcarousel?
The agent-first secret vault. Coding agents store, rotate, and share secrets — AES-256-GCM encrypted, audited, autonomous.
How to use Secretcarousel?
The README includes setup instructions such as npx secretcarousel signup my-project --local.
Key features of Secretcarousel
- Claim tokens — hand a secret to another agent/tenant via a one-time, scoped, expiring, audited token
- Rotation — rotate now or on a schedule, with email alerts
- Sharing — time- and view-limited links for humans
- Environments — export as .env, promote secrets between environments
- Scoped API keys — read/write/admin per key, project-scoped
Use cases of Secretcarousel
- Connect an MCP-compatible client to this repository's service.
- Review the README-backed setup before enabling it in production.
Frequently asked questions
Does Secretcarousel include a standard MCP config?
If the README contains a parseable MCP configuration block, it is shown in the Config tab.
More Developer Tools MCP servers
LastPing
LastPingKnow when your AI agents, cron jobs and CI pipelines fail, stall or go quiet. Your agent sets up monitors from a plain description, tells you what is broken and why, reads run history and traces, and writes notes on inci
GripForge
gripforgeaiThe tools your AI needs to make your games. Turn prompts into production-ready game assets — animated characters with their weapons attached, seamless textures, terrain, VFX, HUDs — and playable game kits Unity, Godot, U
1
Mcp-Warden
ermolukLocal-first credential broker for MCP. AI coding agents (Claude Code, Cursor, Codex…) call APIs, SSH and databases through scoped presets; secrets stay in your OS keychain and never enter the agent's context.
4
Moxie Docs
Jackalope-DevAutomated codebase documentation for GitHub: searchable docs, MCP context for AI agents, doc drift detection, and Friday Cleanup PRs.
1
Vibgrate MCP
VibgrateQuery your team's drift, vulnerability, and migration data from any AI assistant. Vibgrate MCP connects Cursor, Claude, ChatGPT, Windsurf, or VS Code to Vibgrate Cloud: 51 tools for DriftScores, CVEs and EOL runtimes, up
3
Comments