🔐 janee-mcp-demo

An MCP server that uses Janee for secrets management.

Stop hardcoding API keys in your MCP server configs. This demo shows how to use Janee's encrypted vault to securely manage secrets for AI agents.

Why?

MCP servers often need API keys (GitHub tokens, OpenAI keys, database credentials). The typical approach is environment variables or plaintext config files — both are insecure and hard to manage.

Janee provides:

🔒 AES-256-GCM encrypted vault for all secrets
🔑 Single master password protects everything
🛠️ CLI for adding/rotating secrets
🤖 Runtime decryption — secrets never touch disk in plaintext

Quick Start

# Clone this demo
git clone https://github.com/lucamorettibuilds/janee-mcp-demo
cd janee-mcp-demo
npm install

# Initialize Janee vault
npx janee init

# Add your API keys
npx janee add github    # Paste your GitHub token
npx janee add openai    # Paste your OpenAI key

# Start the MCP server
npm start

Using with Claude Desktop

Add to your Claude Desktop MCP config (claude_desktop_config.json):

{
  "mcpServers": {
    "janee-demo": {
      "command": "node",
      "args": ["/path/to/janee-mcp-demo/src/server.js"],
      "env": {
        "JANEE_MASTER_PASSWORD": "your-master-password"
      }
    }
  }
}

Available Tools

| Tool | Description | |------|-------------| | github_create_issue | Create GitHub issues using vault credentials | | openai_complete | Call OpenAI API using vault credentials | | list_secrets | List services in the vault (names only) |

How It Works

Claude Desktop → MCP Protocol → This Server → Janee Vault → API Call
                                                    ↑
                                          Encrypted on disk
                                          Decrypted at runtime

The MCP server receives a tool call from Claude
It asks Janee for the required API key
Janee decrypts the key from its vault using the master password
The server makes the API call and returns the result
No secrets are ever stored in plaintext

Adding More Services

# Add any service
npx janee add anthropic
npx janee add stripe
npx janee add aws

# Then use in your server:
const key = await getSecret("stripe", "api_key");

Security Model

Secrets are encrypted with AES-256-GCM
Master password is the only key (set via JANEE_MASTER_PASSWORD env var)
Vault file (.janee/vault.enc) can be safely committed — it's encrypted
Session-based access with automatic expiry

Learn More

Janee on GitHub — The secrets manager
MCP Specification — Model Context Protocol
Blog: I Built an AI Agent That Manages Its Own API Keys

License

MIT

MCP Servers