🔐 janee-mcp-demo

An MCP server that uses Janee for secrets management.

Stop hardcoding API keys in your MCP server configs. This demo shows how to use Janee's encrypted vault to securely manage secrets for AI agents.

Why?

MCP servers often need API keys (GitHub tokens, OpenAI keys, database credentials). The typical approach is environment variables or plaintext config files — both are insecure and hard to manage.

Janee provides:

• 🔒 AES-256-GCM encrypted vault for all secrets
• 🔑 Single master password protects everything
• 🛠️ CLI for adding/rotating secrets
• 🤖 Runtime decryption — secrets never touch disk in plaintext

Quick Start

# Clone this demo
git clone https://github.com/lucamorettibuilds/janee-mcp-demo
cd janee-mcp-demo
npm install

# Initialize Janee vault
npx janee init

# Add your API keys
npx janee add github    # Paste your GitHub token
npx janee add openai    # Paste your OpenAI key

# Start the MCP server
npm start

Using with Claude Desktop

Add to your Claude Desktop MCP config (claude_desktop_config.json):

{
  "mcpServers": {
    "janee-demo": {
      "command": "node",
      "args": ["/path/to/janee-mcp-demo/src/server.js"],
      "env": {
        "JANEE_MASTER_PASSWORD": "your-master-password"
      }
    }
  }
}

Available Tools

How It Works

Claude Desktop → MCP Protocol → This Server → Janee Vault → API Call
                                                    ↑
                                          Encrypted on disk
                                          Decrypted at runtime

1. The MCP server receives a tool call from Claude
2. It asks Janee for the required API key
3. Janee decrypts the key from its vault using the master password
4. The server makes the API call and returns the result
5. No secrets are ever stored in plaintext

Adding More Services

# Add any service
npx janee add anthropic
npx janee add stripe
npx janee add aws

# Then use in your server:
const key = await getSecret("stripe", "api_key");

Security Model

• Secrets are encrypted with AES-256-GCM
• Master password is the only key (set via JANEE_MASTER_PASSWORD env var)
• Vault file (.janee/vault.enc) can be safely committed — it's encrypted
• Session-based access with automatic expiry

Learn More

• Janee on GitHub — The secrets manager
• MCP Specification — Model Context Protocol
• Blog: I Built an AI Agent That Manages Its Own API Keys

License

MIT