---
title: "seekrit"
description: "Zero-knowledge secrets manager for AI agents: bundles seekrit's local crypto-plane and hosted metadata-plane MCP servers."
canonical: https://agentpluginsdirectory.com/plugins/seekrit
last-updated: 2026-09-21
---

# seekrit
Zero-knowledge secrets manager for AI agents: bundles seekrit's local crypto-plane and hosted metadata-plane MCP servers.
- Slug: seekrit
- Publisher: seekrit
- Repository: https://github.com/seekritdev/mcp-plugin
- Manifest: plugin.json
- Version: 1.0.0
- License: MIT
- Category (editorial): security
- Skills: 0
- MCP servers: 2 (seekrit, seekrit-cloud)
- Stars: 0
- Repository created: 2026-07-20
- Repository last pushed: 2026-07-20
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/seekrit
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What seekrit does, in the publisher's words

An Agent Plugin (v1.0.0) packaging the two Model Context Protocol servers for seekrit, a multi-tenant, end-to-end encrypted secrets manager built for AI agents and CI:

- seekrit: the local crypto-plane server (@seekrit/mcp, stdio). Runs on your machine, decrypts secrets, and injects them into commands. This is the one that actually resolves secret values.
- seekrit-cloud: the hosted metadata-plane server (mcp.seekrit.dev, Streamable HTTP). Lets an agent self-register, discover secrets/orgs, and manage access, without ever seeing plaintext. It redirects crypto operations back to the local server.

Both servers are zero-knowledge: plaintext secrets, private keys, and passphrases are only ever handled by @seekrit/mcp running locally. seekrit-cloud never sees them.

You need a machine (M2M) credential pair. Mint one with:

- Docs: MCP server

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/seekritdev/mcp-plugin/HEAD/README.md

## MCP servers

- seekrit: transport: stdio; command: npx -y @seekrit/mcp
- seekrit-cloud: transport: streamable-http; url: https://mcp.seekrit.dev/mcp

Read from the plugin's own mcp.json. Environment variable names only, never values.