rsdouglas/janee
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Secrets management for AI agents via MCP • @janeesecure
概要
Your AI agents need API access to be useful. But they shouldn't have your raw API keys. Janee sits between your agents and your APIs — injecting credentials, enforcing policies, and logging everything. AI agents need API access to be useful. The current approach is to give them your keys and hope they behave. - 🔓 Agents have full access to Stripe, Gmail, databases - 📊 No audit trail of what was accessed or why - 🚫 No kill switch when things go wrong - 💉 One prompt injection away from disaster Janee is an MCP server that manages API secrets for AI agents: 1. — encrypted locally in ~/.janee/ 2. — starts MCP server 3. — via execute MCP tool 4. — agent never sees it 5. — full audit trail Now that connects to Janee can use them: - — access your APIs - — access your APIs - — access your APIs - — access your APIs No more copying keys between tools. No more "which agent has which API configured?" Add a new agent? It already has access to everything. Revoke a key?
README
以下は原文 README の抜粋です。原文を見る。
Janee 🔐
Secrets management for AI agents via MCP
Your AI agents need API access to be useful. But they shouldn’t have your raw API keys. Janee sits between your agents and your APIs — injecting credentials, enforcing policies, and logging everything.
✨ Features
| 🔒 Zero-knowledge agents | Agents call APIs without ever seeing keys |
| 📋 Full audit trail | Every request logged with timestamp, method, path, status |
| 🛡️ Request policies | Allow/deny rules per capability (e.g., read-only Stripe) |
| ⏱️ Session TTLs | Time-limited access with instant revocation |
| 🔌 Works with any MCP client | Claude Desktop, Cursor, OpenClaw, and more |
| 🏠 Local-first | Keys encrypted on your machine, never sent to a cloud |
| 🖥️ Exec mode | Run CLI tools with injected credentials — agents never see the keys |
| 🤖 GitHub App auth | Short-lived tokens for autonomous agents — no static PATs |
| 🐦 Twitter/X OAuth 1.0a | Per-request OAuth signing — 4 secrets stay encrypted |
| ☁️ AWS SigV4 | Sign AWS API requests server-side — SES, S3, and more |
| 🔧 Automatic git auth | git push/pull just works when credentials include GitHub tokens |
The Problem
AI agents need API access to be useful. The current approach is to give them your keys and hope they behave.
- 🔓 Agents have full access to Stripe, Gmail, databases
- 📊 No audit trail of what was accessed or why
- 🚫 No kill switch when things go wrong
- 💉 One prompt injection away from disaster
The Solution
Janee is an MCP server that manages API secrets for AI agents:
- Store your API keys — encrypted locally in
~/.janee/ - Run
janee serve— starts MCP server - Agent requests access — via
executeMCP tool - Janee injects the real key — agent never sees it
- Everything is logged — full audit trail
Your keys stay on your machine. Agents never see them. You stay in control.
Configure Once, Use Everywhere
Set up your APIs in Janee once:
services:
stripe:
baseUrl: https://api.stripe.com
auth: { type: bearer, key: sk_live_xxx }
github:
baseUrl: https://api.github.com
auth: { type: bearer, key: ghp_xxx }
openai:
baseUrl: https://api.openai.com
auth: { type: bearer, key: sk-xxx }
Now every agent that connects to Janee can use them:
- Claude Desktop — access your APIs
- Cursor — access your APIs
インストール
npx @true-and-useful/create-gh-app create my-agent --owner @me