Skip to content
MCPpedia
Submit
Credential Broker logo
MCP server
Registry

Credential Broker MCP Server

Local-first credential broker: agents use gated APIs through scoped, audited requests, never keys.

Credential Broker scores 67 (Good), licensed Apache-2.0 and written in TypeScript. It installs as a local process. It does not declare tools yet. Filed under Security. GitHub shows 2 stars. Install configs are generated for 10 clients. Being listed in the registry is not the same as being vendor-official.

by sarutobisasuke8Apache-2.0TypeScript2 stars
InstallView on GitHub
Trust score
67Good
Trust score 67 of 100, Good

Good trust

67 of 100 from six public signals. Nobody can buy a point.

  • Listed in the official MCP registry.
  • OSI-style license: apache-2.0.
How we score trust
Scorecard

License, quality and maintenance

How grades work
Trust breakdown

Where the 67 comes from

22 + 20 + 2 + 10 + 10 + 3 = 67. Each factor is capped, so no single signal can carry a listing.

Registry22 / 30

Active in the official MCP registry, plus a known vendor namespace.

Registry: 22 of 30 points.
Maintenance20 / 20

How recently the repository saw a commit or release.

Maintenance: 20 of 20 points.
Popularity2 / 20

GitHub stars and weekly downloads, on a log scale.

Popularity: 2 of 20 points.
License10 / 10

A clear, OSI-style open-source license.

License: 10 of 10 points.
Security10 / 10

Not archived, a secure install path, a pinned version.

Security: 10 of 10 points.
Docs3 / 10

A real summary, a README with depth, listed tools.

Docs: 3 of 10 points.

Install

Pick your client, copy the config, paste it in.

Add to Cursor: Credential BrokerInstall in VS Code: Credential BrokerInstall in VS Code Insiders: Credential Broker

Needs Cursor or VS Code installed on this device. The button opens the app and asks you to confirm before it adds the server.

~/Library/Application Support/Claude/claude_desktop_config.json
{  "mcpServers": {    "sarutobisasuke8-credential-broker-mcp": {      "command": "npx",      "args": [        "-y",        "@sarutobi-sasuke/credential-broker-mcp@0.1.1"      ],      "env": {        "BROKER_AGENT_ID": "",        "BROKER_POLICY_FILE": "",        "BROKER_AUDIT_FILE": "",        "BROKER_APPROVALS_FILE": "",        "BROKER_HOT_RELOAD": "",        "BROKER_ALLOW_KEY_REQUESTS": ""      }    }  }}
Install guide

Environment variables

NameRequiredNotes
BROKER_AGENT_IDRequiredWhich agent identity this process is. Must be provisioned in the policy file.
BROKER_POLICY_FILEOptionalPath to the policy YAML (version 2). Defaults to config/broker.yaml.
BROKER_AUDIT_FILEOptionalPath to the content-free audit log. Defaults to data/audit.jsonl.
BROKER_APPROVALS_FILEOptionalPath to the approvals file. Defaults to config/approvals.json.
BROKER_HOT_RELOADOptionalSet to 1 to pick up key manager changes without a restart. Off by default.
BROKER_ALLOW_KEY_REQUESTSOptionalSet to 1 to let this agent ask the operator for a key through the key manager. Off by default.

Tools

All capabilities

Tools show up when the registry metadata or the repository README lists them. Public READMEs are read directly. A GitHub token is used only when one is already configured.

About

Local-first credential broker: agents use gated APIs through scoped, audited requests, never keys.

Frequently asked questions

What is Credential Broker MCP Server?

Local-first credential broker: agents use gated APIs through scoped, audited requests, never keys.

How do I install Credential Broker MCP Server in Claude Desktop, Cursor, or VS Code?

Pick your client in the Install section on this page and copy the generated config into the client's config file. Step-by-step guides: Claude Desktop, Cursor, and VS Code. Credential Broker MCP Server runs locally from the npm package @sarutobi-sasuke/credential-broker-mcp with the command npx -y @sarutobi-sasuke/credential-broker-mcp@0.1.1.

Is Credential Broker MCP Server free and open source?

Yes. Credential Broker MCP Server is released under the Apache-2.0 license, an OSI-approved open-source license, so you can use, modify, and self-host it under those terms.

Does Credential Broker MCP Server support remote (HTTP) connections?

No remote endpoint is listed for Credential Broker MCP Server. It runs locally on your machine over stdio, started by your MCP client.

How is Credential Broker MCP Server's trust score calculated?

Credential Broker MCP Server scores 67 out of 100 (Good). The score adds six capped public signals: registry status, maintenance, popularity, license, documentation, and security. Nobody can pay for points. Read the methodology for the full formula.

Reviews

No reviews yet

—Be the first to review

5 star0 reviews at 5 stars
4 star0 reviews at 4 stars
3 star0 reviews at 3 stars
2 star0 reviews at 2 stars
1 star0 reviews at 1 stars

No published reviews yet. Used it? Tell the next person how it went.

Add badge to your README

Paste either snippet into the repository README. The image links to this listing.

Listed on MCPpedia

Top 5 MCP servers

Daily or weekly. Confirm by email, unsubscribe any time.

How often

Manage this listing

Claim this server
Same category
All alternatives
Trust score 76 of 100, Good

virustotal

by burtthecoder · TypeScript

MCP server for querying VirusTotal API with comprehensive security analysis tools.

Registry
LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 15 days ago.
151 stars403/wk weekly downloads— tools
Trust score 76 of 100, Good

shodan

by burtthecoder · TypeScript

MCP server for Shodan API — device search, IP and domain recon, DNS, and CVE/CPE queries.

Registry
LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 19 days ago.
178 stars344/wk weekly downloads— tools
Trust score 73 of 100, Good

supply-chain-guard

by homeofe · TypeScript

Supply-chain malware scanner and MCP server: vet packages in 15 ecosystems before install, offline.

Registry
LicenseQualityMaintenanceLicense: A. Apache-2.0 is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 22 days ago.
7 stars2K/wk weekly downloads— tools
Trust score 73 of 100, Good

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

Registry
LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: B. Last commit or release 30 days ago.
268 stars—/wk weekly downloads— tools
EchelonGraph CVE & Exposure logo
Trust score 73 of 100, Good

CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.

RegistryRemote
LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 6 days ago.
8 stars1.4K/wk weekly downloads— tools
Trust score 72 of 100, Good

dvalincode

by arthurpanhku · TypeScript

Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.

Registry
LicenseQualityMaintenanceLicense: A. MIT is a permissive open source license.Quality: Not graded. No README or tool list has been captured yet.Maintenance: A. Last commit or release 26 days ago.
117 stars—/wk weekly downloads— tools