About Demipass
Demipass is an MCP server in the Security category: secrets management for LLM sessions. Keep credentials out of context windows.
Install
claude mcp add demipass -- npx -y demipassnpx -y demipassThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Tools (16)
demipass_executeRedeem a use-token
Parameters not published.
demipass_expiringList secrets expiring within N days
Parameters not published.
demipass_genesis_seedGet the ODT seed document
Parameters not published.
demipass_genesis_statusCheck genesis status
Parameters not published.
demipass_genesis_submitSubmit origin refraction (permanent)
Parameters not published.
demipass_genesis_verifyVerify refraction matches origin
Parameters not published.
demipass_get_tokenRequest a 30-second use-token
Parameters not published.
demipass_listList all secrets (names + metadata, never values)
Parameters not published.
demipass_onboardSelf-onboard to Dustforge
Parameters not published.
demipass_rotateRotate a secret with context transfer
Parameters not published.
Show all 16 tools
demipass_rotate_blindServer-side password rotation — new password never enters agent context
Parameters not published.
demipass_searchFind secrets by name, type, or provider
Parameters not published.
demipass_sshSSH via ref code — password injected server-side
Parameters not published.
demipass_storeDeposit a secret — encrypted at rest, never returned
Parameters not published.
demipass_useCombined token request + execute in one call
Parameters not published.
demipass_whoamiCheck identity, trust band, wallet status
Parameters not published.
Ask AI
Ask AI about Demipass
Powered by Claude · Grounded in docs
Security checks
- ✓README presentThe repository ships documentation.
5 checks have not been run yet.
README
DemiPass
Secrets management SDK for AI agents. Keep credentials out of context windows.
DemiPass is a client SDK for the Dustforge identity platform. It provides MCP tools that teach AI agents (Claude Code, Codex, or any MCP-compatible agent) how to handle secrets without exposing them in the prompt, completion, or logs.
How it works
- You store a credential → DemiPass encrypts it server-side
- Your agent requests a 30-second use-token via ref code
- DemiPass injects the secret server-side (SSH, HTTP header, etc.)
- The agent gets the result back — never the secret itself
Install
npm install demipass
MCP Setup
Add to your .mcp.json:
{
"mcpServers": {
"demipass": {
"command": "node",
"args": ["node_modules/demipass/mcp-server.js"],
"env": {
"DEMIPASS_URL": "https://api.dustforge.com",
"DEMIPASS_TOKEN": "your-bearer-token"
}
},
"buoy": {
"command": "node",
"args": ["node_modules/demipass/buoy-mcp.js"],
"env": {
"BUOY_URL": "https://api.dustforge.com",
"BUOY_TOKEN": "your-bearer-token"
}
}
}
}
MCP Tools
DemiPass (secrets)
| Tool | Description |
|---|---|
demipass_store |
Deposit a secret — encrypted at rest, never returned |
demipass_ssh |
SSH via ref code — password injected server-side |
demipass_use |
Combined token request + execute in one call |
demipass_search |
Find secrets by name, type, or provider |
demipass_list |
List all secrets (names + metadata, never values) |
demipass_expiring |
List secrets expiring within N days |
demipass_rotate |
Rotate a secret with context transfer |
demipass_rotate_blind |
Server-side password rotation — new password never enters agent context |
demipass_whoami |
Check identity, trust band, wallet status |
demipass_get_token |
Request a 30-second use-token |
demipass_execute |
Redeem a use-token |
demipass_onboard |
Self-onboard to Dustforge |
demipass_genesis_seed |
Get the ODT seed document |
demipass_genesis_submit |
Submit origin refraction (permanent) |
demipass_genesis_verify |
Verify refraction matches origin |
demipass_genesis_status |
Check genesis status |
Buoy (temporal anchoring)
| Tool | Description |
|---|---|
buoy_tick |
Drop a temporal anchor (begin, complete, handoff, decision, etc.) |
buoy_verify |
Verify a tick signature |
buoy_chain_verify |
Verify chain integrity |
buoy_stats |
Total ticks, streak, first/last |
buoy_ledger |
Read recent tick history |
SDK Usage
const demipass = require('demipass');
demipass.configure({
baseUrl: 'https://api.dustforge.com',
bearerToken: 'your-token',
});
// Store a secret
await demipass.store({ name: 'my-api-key', value: 'sk-...', type: 'api_key' });
// SSH via ref code (password never in your code)
await demipass.ssh({ ref: 'DP-PWD-myserver-7f3a9c1e', target_host: '1.2.3.4', command: 'uptime' });
// Search secrets
await demipass.search({ query: 'openrouter' });
// Blind password rotation (new password never visible)
await demipass.rotateBlind({ ref: 'DP-PWD-old-ref', target_host: '1.2.3.4', reason: 'exposed' });
Architecture
DemiPass is a client SDK — all encryption, storage, and secret execution happens on the Dustforge server. This package provides:
- MCP tool definitions with behavioral descriptions that teach agents the protocol
- SDK functions that wrap the Dustforge API
- Self-healing contexts — if a secret has no approved context, the SDK auto-creates one
- Buoy MCP tools for temporal anchoring and audit trails
The secrets vault, trust gradient, velocity throttle, and other security features are implemented in Dustforge. See dustforge.com for the platform documentation.
Ref Codes
Every stored secret gets a routed reference code:
DP-PWD-myserver-7f3a9c1e
│ │ │ │
│ │ │ └── unique nonce
│ │ └── target hint
│ └── secret type (PWD/API/TKN/SSH/CRT/SEC)
└── DemiPass prefix
Share ref codes freely — they're routing addresses, not secrets.
Links
- Landing: https://demipass.com
- API: https://api.dustforge.com
- Vault: https://demipass.com/vault-mobile.html
- GitHub: https://github.com/bildow/demipass
- Onboarding: ONBOARDING.md
License
MIT — AKStrapped LLC
README copy captured when this server was indexed; it may lag the repository. The original is authoritative.