English Français العربية

com.dustforge/demipass

السجل الرسمي أدوات المطورين

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.

الشيفرة المصدرية الموقع التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

NPM package demipass
Claude Code 
claude mcp add demipass -e 'DEMIPASS_TOKEN=<your demipass_token>' -e 'DEMIPASS_URL=<DEMIPASS_URL>' -- npx -y demipass@2.5.0
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "demipass": {
            "command": "npx",
            "args": [
                "-y",
                "demipass@2.5.0"
            ],
            "env": {
                "DEMIPASS_TOKEN": "<your demipass_token>",
                "DEMIPASS_URL": "<DEMIPASS_URL>"
            }
        }
    }
}

متغيرات البيئة

  • DEMIPASS_TOKEN إلزامي سري Dustforge JWT bearer token. Self-onboard at https://dustforge.com/.well-known/silicon or mint via the 2FA email flow.
  • DEMIPASS_URL API base URL (default https://api.dustforge.com)

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. DemiPass
  2. How it works
  3. Install
  4. MCP Setup
  5. MCP Tools
  6. SDK Usage
  7. Architecture
  8. Ref Codes
  9. Links
  10. License

DemiPass

Secrets management SDK for AI agents. Keep credentials out of context windows.

DemiPass is a client SDK for the Dustforge identity platform. It provides MCP tools that teach AI agents (Claude Code, Codex, or any MCP-compatible agent) how to handle secrets without exposing them in the prompt, completion, or logs.

How it works

  1. You store a credential → DemiPass encrypts it server-side
  2. Your agent requests a 30-second use-token via ref code
  3. DemiPass injects the secret server-side (SSH, HTTP header, etc.)
  4. The agent gets the result back — never the secret itself

Install

npm install demipass

MCP Setup

Add to your .mcp.json:

{
  "mcpServers": {
    "demipass": {
      "command": "node",
      "args": ["node_modules/demipass/mcp-server.js"],
      "env": {
        "DEMIPASS_URL": "https://api.dustforge.com",
        "DEMIPASS_TOKEN": "your-bearer-token"
      }
    },
    "buoy": {
      "command": "node",
      "args": ["node_modules/demipass/buoy-mcp.js"],
      "env": {
        "BUOY_URL": "https://api.dustforge.com",
        "BUOY_TOKEN": "your-bearer-token"
      }
    }
  }
}

MCP Tools

DemiPass (secrets)
ToolDescription
demipass_storeDeposit a secret — encrypted at rest, never returned
demipass_sshSSH via ref code — password injected server-side
demipass_useCombined token request + execute in one call
demipass_searchFind secrets by name, type, or provider
demipass_listList all secrets (names + metadata, never values)
demipass_expiringList secrets expiring within N days
demipass_rotateRotate a secret with context transfer
demipass_rotate_blindServer-side password rotation — new password never enters agent context
demipass_whoamiCheck identity, trust band, wallet status
demipass_get_tokenRequest a 30-second use-token
demipass_executeRedeem a use-token
demipass_onboardSelf-onboard to Dustforge
demipass_genesis_seedGet the ODT seed document
demipass_genesis_submitSubmit origin refraction (permanent)
demipass_genesis_verifyVerify refraction matches origin
demipass_genesis_statusCheck genesis status
Buoy (temporal anchoring)
ToolDescription
buoy_tickDrop a temporal anchor (begin, complete, handoff, decision, etc.)
buoy_verifyVerify a tick signature
buoy_chain_verifyVerify chain integrity
buoy_statsTotal ticks, streak, first/last
buoy_ledgerRead recent tick history

SDK Usage

const demipass = require('demipass');

demipass.configure({
  baseUrl: 'https://api.dustforge.com',
  bearerToken: 'your-token',
});

// Store a secret
await demipass.store({ name: 'my-api-key', value: 'sk-...', type: 'api_key' });

// SSH via ref code (password never in your code)
await demipass.ssh({ ref: 'DP-PWD-myserver-7f3a9c1e', target_host: '1.2.3.4', command: 'uptime' });

// Search secrets
await demipass.search({ query: 'openrouter' });

// Blind password rotation (new password never visible)
await demipass.rotateBlind({ ref: 'DP-PWD-old-ref', target_host: '1.2.3.4', reason: 'exposed' });

Architecture

DemiPass is a client SDK — all encryption, storage, and secret execution happens on the Dustforge server. This package provides:

  • MCP tool definitions with behavioral descriptions that teach agents the protocol
  • SDK functions that wrap the Dustforge API
  • Self-healing contexts — if a secret has no approved context, the SDK auto-creates one
  • Buoy MCP tools for temporal anchoring and audit trails

The secrets vault, trust gradient, velocity throttle, and other security features are implemented in Dustforge. See dustforge.com for the platform documentation.

Ref Codes

Every stored secret gets a routed reference code:

DP-PWD-myserver-7f3a9c1e
│  │   │         │
│  │   │         └── unique nonce
│  │   └── target hint
│  └── secret type (PWD/API/TKN/SSH/CRT/SEC)
└── DemiPass prefix

Share ref codes freely — they're routing addresses, not secrets.

License

MIT — AKStrapped LLC

الأسئلة الشائعة

ما هو com.dustforge/demipass؟

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.

كيف أثبّت com.dustforge/demipass؟

يعمل على جهازك. في Claude Code: claude mcp add demipass -e 'DEMIPASS_TOKEN=<your demipass_token>' -e 'DEMIPASS_URL=<DEMIPASS_URL>' -- npx -y demipass@2.5.0. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج com.dustforge/demipass إلى مفتاح API؟

نعم. يتطلب DEMIPASS_TOKEN، وتضبطها في إعداداته.

هل com.dustforge/demipass مفتوح المصدر؟

شيفرته علنية على GitHub، لكن المستودع لا يعلن ترخيصًا قياسيًا.

من يصون com.dustforge/demipass؟

ينشره bildow. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.