English Français العربية

org.proxykey/proxykey

Registre officiel IA et agents

Issue, rotate and revoke scoped API-key passes for 25+ providers — the agent never sees a real key

Code source Site web Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http proxykey 'https://mcp.proxykey.org/mcp' --header 'Authorization: <Bearer token minted in the proxykey panel (https://app.proxykey.org, MCP section). Format: '\''Bearer mcp_...'\''>'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "proxykey": {
            "type": "http",
            "url": "https://mcp.proxykey.org/mcp",
            "headers": {
                "Authorization": "<Bearer token minted in the proxykey panel (https://app.proxykey.org, MCP section). Format: 'Bearer mcp_...'>"
            }
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. proxykey MCP server
  2. Why give an agent this instead of a key
  3. Quick start
  4. Tools (13)
  5. The proxy itself
  6. Security model (short version)

proxykey MCP server

Issue, rotate and revoke API-key passes from your AI agent — without the agent ever seeing a real key.

proxykey is a credential vault and proxy: your real API keys (OpenAI, Anthropic, Telegram, Stripe, 25+ providers) are encrypted with AES-256-GCM and never leave the server. Apps and agents use revocable virtual keys — passes (vlt_…) — with per-pass IP binding, rate limits and full request logs. This MCP server lets an agent manage those passes.

Why give an agent this instead of a key

Anything that enters a model's context can leak — through logs, traces or prompt injection. With proxykey the agent gets a tool, not a secret:

  • the agent can create / rotate / revoke / inspect passes;
  • a "read the real key" operation does not exist in the toolset;
  • only a human can enter the original key, in the panel;
  • a leaked pass is a non-event: wrong IP → 403, over limit → 429, revocation is one click and doesn't touch the original.

Quick start

  1. Sign in at https://app.proxykey.org (GitHub OAuth or email magic link, free).
  2. Open MCP → create a token (mcp_…).
  3. Connect your client:

Claude Code

claude mcp add --transport http proxykey https://mcp.proxykey.org/mcp \
  --header "Authorization: Bearer mcp_YOUR_TOKEN"

Claude Desktop / Cursor (mcp.json)

{
  "mcpServers": {
    "proxykey": {
      "url": "https://mcp.proxykey.org/mcp",
      "headers": { "Authorization": "Bearer mcp_YOUR_TOKEN" }
    }
  }
}

Tools (13)

ToolWhat it does
list_providersProvider catalogue (slugs, auth models)
list_secretsStored keys (metadata only — never values)
get_manual_secret_setupLink for a human to enter a key
list_passesAll passes with status, limits, binding
create_passIssue a pass for an existing secret
create_pending_passIssue a pass before the key exists; a human fills the key in later, the pass activates automatically
update_passChange limits, IP mode, expiry
revoke_pass / delete_passKill a pass instantly / remove a revoked one
rotate_passReissue the token, same settings
rebind_pass_ipReset IP learning
get_pass_logs / get_pass_statsPer-pass request log and usage stats

The proxy itself

Point your client at the proxy and use the pass as the API key — only the host and the key change:

# before
curl https://api.openai.com/v1/chat/completions -H "Authorization: Bearer sk-..."
# after
curl https://api.proxykey.org/p/openai/v1/chat/completions -H "Authorization: Bearer vlt_openai_..."

Streaming (SSE), request bodies and headers pass through unchanged. Telegram bots keep their URL shape (/p/telegram-bot/<pass>/getMe). Full reference: https://app.proxykey.org/docs.html

Security model (short version)

  • Secrets: AES-256-GCM envelope encryption, decrypted in memory per request, never logged, never returned by any API after creation.
  • Pass tokens and MCP tokens are stored hashed (SHA-256).
  • MCP surface cannot create or read secret values, or toggle body logging — those stay human-only in the panel.
  • Request logs contain metadata only — no auth headers, no key material.

Questions fréquentes

Qu'est-ce que org.proxykey/proxykey ?

Issue, rotate and revoke scoped API-key passes for 25+ providers — the agent never sees a real key

Comment installer org.proxykey/proxykey ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http proxykey 'https://mcp.proxykey.org/mcp' --header 'Authorization: <Bearer token minted in the proxykey panel (https://app.proxykey.org, MCP section). Format: '\''Bearer mcp_...'\''>'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour org.proxykey/proxykey ?

Oui. Il attend Authorization, à renseigner dans sa configuration.

org.proxykey/proxykey est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient org.proxykey/proxykey ?

Il est publié par neostorm112-boop. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.