MCP-warden local credential broker so AI agents never see your secrets
TL;DR
I got tired of pasting GitHub PATs, Stripe keys and DB passwords into Claude Code / Cursor MCP configs. One prompt injection or a leaked chat and they’re gone. So I built mcp-warden — a local-first credential broker for the Model Context Protocol. How it works:. You store the secret once in the OS keychain. You define scoped presets (e.g. github-read, stripe-charges). The agent calls high-level tools (proxy_http, ssh_exec, db_query).
Nauti's Take
Start with a tightly scoped read-only preset for GitHub or a test database. Verify that allow-lists cover every destination and action, inspect what data comes back into the agent context, and test approvals during unattended runs.
A local broker can reduce credential exposure, but it also becomes a high-value component that needs its own security review.
Sources