enigmagent-mcp 2.0.0

enigmagent-mcp is a local encrypted vault server for MCP-capable clients. It
stores secret values with an Argon2id-derived AES-256-GCM key and keeps the
vault file encrypted at rest.

Version 2.0.0 makes the security boundary explicit:

• MCP starts in metadata-only mode. Raw secret resolution is disabled unless the
  operator passes --allow-raw-resolve or sets ENIGMAGENT_ALLOW_RAW_RESOLVE=1.
• REST binds to 127.0.0.1 and requires a 32–256 character Bearer token.
• REST requests have bounded headers, bodies, and timeouts; responses do not
  include arbitrary exception messages or permissive browser CORS.
• Vault writes use a temporary file, flush, replacement, and a recovery backup.
• Version 1 vaults remain readable. New vaults use format version 2 and the
  versioned KDF context enigma/v2.

Raw resolution is deliberately an opt-in escape hatch. A caller-declared origin
is not proof of the network destination, and a trusted MCP client can still pass
returned plaintext to its model. Do not enable raw resolution for an untrusted
client or a shared process.

Install and run

npx [email protected] --vault ./my.vault.json

The first run prompts for the existing vault credentials when attached to a
terminal. For a trusted headless process, set ENIGMAGENT_USER and
ENIGMAGENT_PASS in its private environment. The server does not print either
value.

MCP modes

The stdio transport implements bounded JSON-RPC MCP initialization, ping,
tools/list, and tools/call. The default tool is:

• enigmagent_list: names, domains, and creation timestamps only.

With explicit raw-resolution opt-in, it additionally exposes:

• enigmagent_resolve: returns a value only when the requested origin matches
  the entry's domain binding.

The origin is normalized and limited to HTTP(S) URLs without embedded user
credentials. Notifications, malformed JSON, oversized frames, invalid tool
arguments, and calls before initialization are handled without terminating the
process.

Authenticated REST

set ENIGMAGENT_API_TOKEN=use-a-random-32-character-token-or-longer
npx [email protected] --mode rest --port 3737 --vault ./my.vault.json

GET /health is a minimal unauthenticated liveness check. GET /status and
GET /list require Authorization: Bearer <token>. POST /resolve also
requires the token, JSON content type, and the explicit raw-resolution flag.
The service rejects browser-origin requests and binds only to loopback.

Client configuration adapters

integrations.js provides tested configuration builders for Claude Desktop,
Cursor, Continue, Cline, Open WebUI, AnythingLLM, LM Studio, Zed, Goose, and
Windsurf. They are maintained configuration examples using the standard MCP
stdio command; they are not upstream plugins, endorsements, or claims of
adoption by those projects.

Development and verification

npm ci
npm test
npm run check
npm run benchmark
npm pack --dry-run

The tests cover encrypted-at-rest behavior, domain matching, wrong credentials,
version-1 migration reads, backup recovery, bounded MCP framing and session
ordering, authenticated REST, and all ten configuration adapters. The benchmark
uses synthetic data and reports create/add/resolve latency without printing a
secret.

Release contents

The historical 1.0.5 tree is preserved in versions/1.0.5/ with its source
archive and SHA-256 manifest. The 2.0.0 release is represented consistently in
package.json, server.json, and manifest.json; publication remains subject
to the repository's CI and release checks.

Scope and threat model

This project protects vault contents from ordinary plaintext-at-rest exposure
and from accidental return by the metadata listing tool. It does not protect
against a compromised operating system, a process with access to the unlocked
memory, malicious client code, side channels, swap/core dumps, or an operator
who explicitly enables raw resolution for an untrusted model. Review
SECURITY.md in the main EnigmAgent project for broader ecosystem guidance.

MIT licensed. See LICENSE.