Use passwords and API keys from your KeyZula vault without the assistant seeing them.
Connect Runs on your machine
claude mcp add keyzula -e KEYZULA_SERVICE_TOKEN=<KEYZULA_SERVICE_TOKEN> -e KEYZULA_MCP_ALLOW_REVEAL=<KEYZULA_MCP_ALLOW_REVEAL> -- npx -y @keyzula/[email protected]{
"mcpServers": {
"keyzula": {
"command": "npx",
"args": [
"-y",
"@keyzula/[email protected]"
],
"env": {
"KEYZULA_SERVICE_TOKEN": "<KEYZULA_SERVICE_TOKEN>",
"KEYZULA_MCP_ALLOW_REVEAL": "<KEYZULA_MCP_ALLOW_REVEAL>"
}
}
}
}{
"mcpServers": {
"keyzula": {
"command": "npx",
"args": [
"-y",
"@keyzula/[email protected]"
],
"env": {
"KEYZULA_SERVICE_TOKEN": "<KEYZULA_SERVICE_TOKEN>",
"KEYZULA_MCP_ALLOW_REVEAL": "<KEYZULA_MCP_ALLOW_REVEAL>"
}
}
}
}{
"servers": {
"keyzula": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@keyzula/[email protected]"
],
"env": {
"KEYZULA_SERVICE_TOKEN": "<KEYZULA_SERVICE_TOKEN>",
"KEYZULA_MCP_ALLOW_REVEAL": "<KEYZULA_MCP_ALLOW_REVEAL>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
KEYZULA_SERVICE_TOKENOptional, secret | Optional service account token (kzsa_1_…). Without it, the server uses your unlocked `keyzula ssh-agent`. |
KEYZULA_MCP_ALLOW_REVEALOptional | Set to true to offer read_secret; every request still needs approval in a window on your computer. |
Details
| Package | @keyzula/[email protected] (NPM, stdio) |
| First published | 5 Nov 2026 |
| Last updated | 5 Nov 2026 |
| Registry name | com.keyzula/keyzula |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.