AI clients

keymitt speaks MCP over stdio, so any client that can launch a local MCP server can use it. The command is always:

keymitt mcp

Claude Code

keymitt setup claude

prints the exact command for your installation, for example:

claude mcp add --scope user keymitt -- /Users/you/.cargo/bin/keymitt mcp

--scope user makes keymitt available in every project. Restart Claude Code afterwards.

Other clients

Add a stdio server whose command is the full path to keymitt and whose argument is mcp. In clients configured with JSON, that usually looks like:

{
  "mcpServers": {
    "keymitt": { "command": "/usr/local/bin/keymitt", "args": ["mcp"] }
  }
}

The server tells the agent how to behave in its MCP instructions: never ask for secret values in chat, refer to secrets as {{secret:NAME}}, prefer http_request for APIs, don't repeat a denied request, and use read_file_redacted for config files.

Hardening your client

keymitt protects secrets that flow through it. An agent with a shell can still read a credential file directly, so tell your client to stop it — the agent will then reach for read_file_redacted. In Claude Code, add deny rules to ~/.claude/settings.json:

{
  "permissions": {
    "deny": [
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(~/.pgpass)",
      "Read(~/.netrc)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/credentials)"
    ]
  }
}

Adapt the list to where your credentials live. Read rules do not stop a shell command such as cat .env; your client's own permission prompts for shell commands remain your line of defence there.

Logging

keymitt mcp logs to standard error, at warn level by default. Set KEYMITT_LOG=info (or debug) for more. Logs never contain secret values.