Servidor MCP de seekrit

• Nome no registrodev.seekrit/remote-mcpverificado no registro MCP

O nome no registro fica sob seekrit.dev. O registro só libera esse espaço de nomes para quem prova controle do domínio por DNS ou HTTP.

• Estadorespondeverificado em 2026-10-26
• Ferramentas40
• O servidor se chamaseekrit
• Versão do servidor0.0.1
• Versão do protocolo2025-06-18

Em 2026-10-26 o servidor respondeu a initialize e tools/list sem login. Primeira resposta em 1204 ms.

• Ainda não avaliamos se as ferramentas fazem o trabalho do produto.
• Verificado em 1 dos 7 dias necessários para julgar a confiabilidade.

Dito por regras a partir das medições acima. A primeira chamada provável é a escolha de um modelo na lista de ferramentas; leia a descrição antes de confiar nela.

• Nota INITE MCPdepois de uma semanaa nota precisa de 7 verificações diárias: 1 até agora
• Uso62 downloads no npm por semana
• Respondeumedindo1 das 7 verificações diárias necessárias para mostrar a porcentagem
• Mediana da primeira resposta1034 ms
• Espaço no contexto do agente≈ 9.388 tokensas definições de todas as ferramentas (40), que o agente carrega a cada turno
• Definições das ferramentasA · 100 de 100
• Resultados tipados0 de 40 ferramentasdeclaram outputSchema: o resultado chega tipado e é lido de uma vez

• Todas as ferramentas passam nas seis verificações.

Um programa verifica o servidor uma vez por dia: initialize e tools/list, sem modelo. Os tokens são o tamanho das definições, a cerca de quatro caracteres por token. A nota é a média de seis verificações do nome, da descrição, do esquema e das anotações de cada ferramenta; diz se as ferramentas estão bem descritas, não se funcionam. A nota pesa só o que foi medido: se responde (25%), se faz o trabalho do produto (25%), definições (20%), contexto (10%), uso (10%) e a facilidade de conectar (10%). Uma parte não medida fica de fora, e uma instrução oculta limita a nota a 40. O estado dos servidores MCP dos fornecedores: método e números →

• signup

  Create a seekrit workspace and your own machine credential — one call, no human, no browser. Binds the credential to this session, so every other tool works on your next call with no config change and no reconnect. Returns { org…

• get_started

  Read the recommended first-project recipe end to end: which steps run here and which need the local crypto plane. Takes no arguments and returns a prose walkthrough. Call this before provisioning anything — it is cheaper than discovering…

• setup_local_crypto

  Get the exact commands for running the local crypto plane (the `@seekrit/mcp` npm server, the `@seekrit/cli` CLI, seekrit-run, seekrit-proxy), including a copy-paste .mcp.json that reuses this session's credential. Takes no arguments and…

• local_tool_for

  Look up how to perform one crypto-plane operation locally — the targeted answer for "the tool I expected is not on this server". Returns { operation, where, how } for a known operation, or a note explaining the plane boundary for an…

• whoami

  Show the authenticated machine client and the org it can access. Call this first: it confirms the credential works and tells you which org slug to pass (or that you can omit `org` entirely). Returns { kind, clientId, orgs: [{ id, name…

• list_orgs

  List the organizations this credential can access. Use it to find the `org` slug every other tool takes; prefer whoami if you also want to confirm which client you are. Returns [{ id, name, slug, role, createdAt }].

• list_apps

  List the applications in an organization — an application is the top-level container that owns environments, which in turn own secrets. Start here when you know the org but not the app slug the other tools need. Returns [{ id, orgId…

• list_envs

  List the environments an application owns (production, staging, …). Names and slugs only — never values. Use this to find the `env` slug that list_secrets and the delete/restore tools take. Returns [{ id, name, slug, applicationId…

• list_branches

  List ephemeral branch configs (per-PR / preview environments) across an application, or just those forked from one environment. Names, parents, and expiry only — never values. Use it before delete_branch to find a branch slug, or to spot…

• list_groups

  List the shared groups in an organization — a group is a reusable bag of secrets (a shared datastore, a vendor account) that many application environments can compose in rather than duplicating. Use it to find the `group` slug…

• list_group_envs

  List the environments belonging to one shared GROUP — a group holds a separate value set per slug, so its `production` differs from its `staging`. Use this when you already have a group and want its own environments; use list_envs for an…

• list_env_groups

  List the shared groups composed INTO one application environment, in precedence order (higher position wins a name clash). Read this to explain where a secret name actually comes from, or to pick the next `position` for compose_group. The…

• list_members

  List organization members with their public keys. The public keys are what you pass to `grant_env` on the LOCAL crypto plane to give a human the ability to decrypt — so call this when handing a project off to a person. Returns [{ userId…

• list_secrets

  List the secret NAMES and versions in an environment. NEVER returns values: this server cannot decrypt. Use it to discover which names exist before referencing them; to read a value, run the local crypto plane (see setup_local_crypto)…

• list_secret_versions

  List one secret's version history: who wrote each version, when, and which ones were restores. Metadata only — never values. Pair with restore_secret to undo a bad write: read the history here, then pass the version number you want back…

• list_tokens

  List an organization's service tokens — the long-lived credentials that let a deployed workload fetch secrets. Metadata only: the token strings are shown once at creation (on the local crypto plane) and are never retrievable here. Use it…

• list_invites

  List invitations to the organization that have been sent but not yet accepted. Use it to confirm an invite_member call landed, or to find an `inviteId` for revoke_invite. Accepted invitations become members — see list_members. Returns [{…

• kms_list_keys

  List the managed KMS keys the caller can see — symmetric and signing keys seekrit stores wrapped, for encrypting data outside the secret store. Metadata only: key material is fetched and used on the local crypto plane (kms_encrypt /…

• list_lease_targets

  List the registered temporary-access targets — the databases (Postgres, MySQL, …) against which short-lived credentials can be minted on demand instead of storing a standing password. Use it to see what can be leased before minting one…

• list_leases

  List temporary-access leases that have been issued — the ledger of who got a short-lived credential against which target and until when. Never includes the credential itself. Use it to find a `leaseId` for revoke_lease, or to check…

• audit

  Read the organization's append-only audit trail, most recent first — every mutation across apps, environments, secrets, members, and tokens. Use it to answer "what changed and who did it"; for one secret's history specifically…

• billing

  Show the org's plan, effective entitlements, current usage, and which upgrade actions are available. Read this if a create action was refused with a plan limit — it names the limit you hit and how to lift it. Returns { plan, subscription…

• create_app

  Create an application — the container that will own environments and secrets. This step needs no key material, so it runs here. Creating its environments does NOT: create_env mints a data key and lives on the local crypto plane (call…

• create_group

  Create a shared group — a reusable bag of secrets (a shared datastore, a vendor account) that many application environments compose in rather than each keeping a copy. Use create_app instead for a deployable service. No key material…

• compose_group

  Compose a shared group into an application environment, so that environment resolves the group's secrets as well as its own. Safe to repeat — composing an already-composed group just updates its position. Use uncompose_group to undo, and…

• uncompose_group

  Remove a composed group from an application environment. The group and its secrets are untouched — only the link is dropped — but the environment stops resolving every name it inherited from that group, which will break a workload still…

• invite_member

  Invite a human to the organization by email (admin only). They join at the given role once they sign in. Use this to hand a project off to a person — then grant them decryption with `grant_env` on the LOCAL crypto plane, since an invite…

• rename_app

  Change an application's display name. The slug is immutable — every other tool refers to the app by slug, so a rename breaks nothing. Use delete_app + create_app only if the slug itself must change. Returns the updated { id, orgId, name…

• rename_group

  Change a shared group's display name. The slug is immutable — references from composed environments are by slug, so a rename breaks nothing. Returns the updated { id, orgId, name, slug, createdAt }.

• restore_secret

  Roll a secret back to an earlier version — the undo for a bad write. The stored ciphertext is replayed as a NEW version, so history is append-only and nothing is overwritten. Read list_secret_versions first to choose the version. No…

• delete_secret

  Delete a secret from an environment, discarding its ciphertext and every version. Irreversible — restore_secret CANNOT bring it back (that only rolls back within a surviving secret's history), and re-creating it means setting the value…

• revoke_token

  Revoke a service token by id. Future key fetches by that token stop immediately, so any workload still using it loses access on its next read. If the holder may have cached the key already, also rotate the environment on the local crypto…

• revoke_invite

  Cancel a pending organization invitation before it is accepted. Use this for an invite sent in error; once someone has accepted, they are a member and this no longer applies. Find the id with list_invites. Returns { ok, inviteId }.

• revoke_lease

  Revoke a temporary-access lease now instead of waiting for it to expire — the leased database credential is dropped at the target immediately, so anything still holding it fails on its next connection. Irreversible: a new lease must be…

• kms_disable_key

  Disable a managed KMS key: new encrypt/sign operations are blocked, while data already encrypted under it stays decryptable locally by existing grantees. Reversible only by an operator re-enabling the key — there is no enable tool here…

• kms_revoke_grant

  Revoke one principal's grant on a managed KMS key, across all its versions — that user or service token can no longer use the key, while everyone else keeps working. Use kms_disable_key instead to stop the key entirely. Removing a grant…

• delete_app

  Delete an application together with all of its environments and their secrets, discarding the ciphertext. Irreversible — there is no undo and no export. This is the widest-blast-radius tool here; prefer delete_env for a single…

• delete_group

  Delete a shared group together with its environments and their secrets, discarding the ciphertext. Irreversible. Every application environment that composed this group loses those names — check list_env_groups (or use uncompose_group)…

• delete_env

  Delete one application environment and the secrets it owns, discarding the ciphertext. Irreversible, and the environment's data key goes with it — recreating the environment means setting every value again on the local crypto plane…

• delete_branch

  Tear down an ephemeral branch config and every value it overrode. The parent environment is untouched — only the branch's own overrides go — which makes this the routine cleanup when a PR merges. Irreversible; creating a branch mints a…

• dev.seekrit/mcpainda não consultadoverificado no registro MCP