English Français العربية

com.dustforge/demipass

Registre officiel Outils de développement

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.

Code source Site web Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

NPM package demipass
Claude Code 
claude mcp add demipass -e 'DEMIPASS_TOKEN=<your demipass_token>' -e 'DEMIPASS_URL=<DEMIPASS_URL>' -- npx -y demipass@2.5.0
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "demipass": {
            "command": "npx",
            "args": [
                "-y",
                "demipass@2.5.0"
            ],
            "env": {
                "DEMIPASS_TOKEN": "<your demipass_token>",
                "DEMIPASS_URL": "<DEMIPASS_URL>"
            }
        }
    }
}

Variables d'environnement

  • DEMIPASS_TOKEN obligatoire secret Dustforge JWT bearer token. Self-onboard at https://dustforge.com/.well-known/silicon or mint via the 2FA email flow.
  • DEMIPASS_URL API base URL (default https://api.dustforge.com)

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. DemiPass
  2. How it works
  3. Install
  4. MCP Setup
  5. MCP Tools
  6. SDK Usage
  7. Architecture
  8. Ref Codes
  9. Links
  10. License

DemiPass

Secrets management SDK for AI agents. Keep credentials out of context windows.

DemiPass is a client SDK for the Dustforge identity platform. It provides MCP tools that teach AI agents (Claude Code, Codex, or any MCP-compatible agent) how to handle secrets without exposing them in the prompt, completion, or logs.

How it works

  1. You store a credential → DemiPass encrypts it server-side
  2. Your agent requests a 30-second use-token via ref code
  3. DemiPass injects the secret server-side (SSH, HTTP header, etc.)
  4. The agent gets the result back — never the secret itself

Install

npm install demipass

MCP Setup

Add to your .mcp.json:

{
  "mcpServers": {
    "demipass": {
      "command": "node",
      "args": ["node_modules/demipass/mcp-server.js"],
      "env": {
        "DEMIPASS_URL": "https://api.dustforge.com",
        "DEMIPASS_TOKEN": "your-bearer-token"
      }
    },
    "buoy": {
      "command": "node",
      "args": ["node_modules/demipass/buoy-mcp.js"],
      "env": {
        "BUOY_URL": "https://api.dustforge.com",
        "BUOY_TOKEN": "your-bearer-token"
      }
    }
  }
}

MCP Tools

DemiPass (secrets)
ToolDescription
demipass_storeDeposit a secret — encrypted at rest, never returned
demipass_sshSSH via ref code — password injected server-side
demipass_useCombined token request + execute in one call
demipass_searchFind secrets by name, type, or provider
demipass_listList all secrets (names + metadata, never values)
demipass_expiringList secrets expiring within N days
demipass_rotateRotate a secret with context transfer
demipass_rotate_blindServer-side password rotation — new password never enters agent context
demipass_whoamiCheck identity, trust band, wallet status
demipass_get_tokenRequest a 30-second use-token
demipass_executeRedeem a use-token
demipass_onboardSelf-onboard to Dustforge
demipass_genesis_seedGet the ODT seed document
demipass_genesis_submitSubmit origin refraction (permanent)
demipass_genesis_verifyVerify refraction matches origin
demipass_genesis_statusCheck genesis status
Buoy (temporal anchoring)
ToolDescription
buoy_tickDrop a temporal anchor (begin, complete, handoff, decision, etc.)
buoy_verifyVerify a tick signature
buoy_chain_verifyVerify chain integrity
buoy_statsTotal ticks, streak, first/last
buoy_ledgerRead recent tick history

SDK Usage

const demipass = require('demipass');

demipass.configure({
  baseUrl: 'https://api.dustforge.com',
  bearerToken: 'your-token',
});

// Store a secret
await demipass.store({ name: 'my-api-key', value: 'sk-...', type: 'api_key' });

// SSH via ref code (password never in your code)
await demipass.ssh({ ref: 'DP-PWD-myserver-7f3a9c1e', target_host: '1.2.3.4', command: 'uptime' });

// Search secrets
await demipass.search({ query: 'openrouter' });

// Blind password rotation (new password never visible)
await demipass.rotateBlind({ ref: 'DP-PWD-old-ref', target_host: '1.2.3.4', reason: 'exposed' });

Architecture

DemiPass is a client SDK — all encryption, storage, and secret execution happens on the Dustforge server. This package provides:

  • MCP tool definitions with behavioral descriptions that teach agents the protocol
  • SDK functions that wrap the Dustforge API
  • Self-healing contexts — if a secret has no approved context, the SDK auto-creates one
  • Buoy MCP tools for temporal anchoring and audit trails

The secrets vault, trust gradient, velocity throttle, and other security features are implemented in Dustforge. See dustforge.com for the platform documentation.

Ref Codes

Every stored secret gets a routed reference code:

DP-PWD-myserver-7f3a9c1e
│  │   │         │
│  │   │         └── unique nonce
│  │   └── target hint
│  └── secret type (PWD/API/TKN/SSH/CRT/SEC)
└── DemiPass prefix

Share ref codes freely — they're routing addresses, not secrets.

License

MIT — AKStrapped LLC

Questions fréquentes

Qu'est-ce que com.dustforge/demipass ?

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.

Comment installer com.dustforge/demipass ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add demipass -e 'DEMIPASS_TOKEN=<your demipass_token>' -e 'DEMIPASS_URL=<DEMIPASS_URL>' -- npx -y demipass@2.5.0. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour com.dustforge/demipass ?

Oui. Il attend DEMIPASS_TOKEN, à renseigner dans sa configuration.

com.dustforge/demipass est-il open source ?

Son code est public sur GitHub, mais le dépôt ne déclare pas de licence standard.

Qui maintient com.dustforge/demipass ?

Il est publié par bildow. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.