by Signet-AI · Signet-AI/signetai
Local-first vault for agent secrets — agents reference secret names, not values; values never leave your machine.
Signet keeps the model honest: agent prompts reference secrets by name; Signet resolves them at call time inside tools. This prevents accidental secret leakage into model context and provider logs.
%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"signet-ai-skill": {
"command": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
],
"_inferred": true
}
}
}Open Claude Desktop → Settings → Developer → Edit Config. Restart after saving.
{
"mcpServers": {
"signet-ai-skill": {
"command": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
],
"_inferred": true
}
}
}Cursor uses the same mcpServers schema as Claude Desktop. Project config wins over global.
{
"mcpServers": {
"signet-ai-skill": {
"command": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
],
"_inferred": true
}
}
}Click the MCP Servers icon in the Cline sidebar, then "Edit Configuration".
{
"mcpServers": {
"signet-ai-skill": {
"command": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
],
"_inferred": true
}
}
}Same shape as Claude Desktop. Restart Windsurf to pick up changes.
{
"mcpServers": [
{
"name": "signet-ai-skill",
"command": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
]
}
]
}Continue uses an array of server objects rather than a map.
{
"context_servers": {
"signet-ai-skill": {
"command": {
"path": "git",
"args": [
"clone",
"https://github.com/Signet-AI/signetai"
]
}
}
}
}Add to context_servers. Zed hot-reloads on save.
claude mcp add signet-ai-skill -- git clone https://github.com/Signet-AI/signetaiOne-liner. Verify with claude mcp list. Remove with claude mcp remove.
When to use: You're shipping an agent that touches APIs and don't want raw keys in prompts.
Outcome: Tools call APIs without leaking secrets into prompts.
Layer secret-hygiene with destructive-op guards
| Tool | Inputs | When to call | Cost |
|---|---|---|---|
| vault add / list / resolve | (see docs) | Three flows | 1 call |
secrets-read secrets-writeput plaintext secrets in skills/configsResolution failsConfirm the secret name; case-sensitive
| Alternative | When to use it instead | Tradeoff |
|---|---|---|
| 1Password CLI | You already have 1Password | Not agent-aware |