Mcpv — AI skill for Claude Code

mcpv

**Offline, encrypted secrets for AI agents: they can use them, but never see them.**

AI coding agents like Claude Code are right not to handle raw secrets. A value pasted into a prompt ends up in the transcript, in logs, and possibly in a commit. `mcpv` keeps the values out of the agent's reach but still lets it run your app:

# .env: commit it, paste it, let an agent read it. It holds addresses, not values.
DATABASE_URL=mcpm://acme/api/dev/DATABASE_URL
STRIPE_KEY=mcpm://acme/api/dev/STRIPE_KEY
PORT=3000

mcpv run -- npm run dev

`run` decrypts the references in memory and passes the values to that one process through its environment. It also scans everything the process prints and replaces secret values with `[redacted]`. The agent sees the command, the key names and the masked output. It never sees a value.

No server, no account, no network. One encrypted file on your machine.

Install

npm i -g @mcpmastersh/mcpv     # installs the `mcpv` command
npx @mcpmastersh/mcpv doctor   # or run it without installing

Needs Node 20 or newer. No runtime dependencies.

Five commands you'll use

# Move an existing .env into the vault and swap its values for references
mcpv import .env --into mcpm://acme/api/dev --only DATABASE_URL,STRIPE_KEY --rewrite

# Add or replace one secret. Type it at a hidden prompt, or pipe it in.
mcpv set mcpm://acme/api/dev/OPENAI_API_KEY
pbpaste | mcpv set mcpm://acme/api/dev/OPENAI_API_KEY

# Run anything with ./.env resolved (or --env-file, or a whole --env environment)
mcpv run -- npm test
mcpv run --env mcpm://acme/api/prod -- ./migrate.sh

# Safe for agents: key names only, never values
mcpv check          # does every reference in ./.env resolve?
mcpv list           # environments and key names

Web UI

mcpv ui

This opens a local page in your browser. From it you can browse environments and key names, add or replace values, import a `.env`, delete secrets, and che