KeyZula
Use passwords and API keys from your KeyZula vault without the assistant seeing them.
Install
Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).
@keyzula/cliclaude mcp add keyzula -e 'KEYZULA_SERVICE_TOKEN=<your keyzula_service_token>' -e 'KEYZULA_MCP_ALLOW_REVEAL=false' -- npx -y @keyzula/cli@1.2.3 mcp
{
"mcpServers": {
"keyzula": {
"command": "npx",
"args": [
"-y",
"@keyzula/cli@1.2.3",
"mcp"
],
"env": {
"KEYZULA_SERVICE_TOKEN": "<your keyzula_service_token>",
"KEYZULA_MCP_ALLOW_REVEAL": "false"
}
}
}
}
Environment variables
KEYZULA_SERVICE_TOKENsecret Optional service account token (kzsa_1_…). Without it, the server uses your unlocked `keyzula ssh-agent`.KEYZULA_MCP_ALLOW_REVEALSet to true to offer read_secret; every request still needs approval in a window on your computer.
Frequently asked questions
What is KeyZula?
Use passwords and API keys from your KeyZula vault without the assistant seeing them.
How do I install KeyZula?
It runs on your machine. In Claude Code: claude mcp add keyzula -e 'KEYZULA_SERVICE_TOKEN=<your keyzula_service_token>' -e 'KEYZULA_MCP_ALLOW_REVEAL=false' -- npx -y @keyzula/cli@1.2.3 mcp. For other clients, paste the JSON configuration from this page into their MCP settings.
Does KeyZula need an API key?
Yes. It expects KEYZULA_SERVICE_TOKEN, which you set in its configuration.
Who maintains KeyZula?
It is published by com.keyzula. AI.tn lists it but does not maintain or endorse it.
From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.