Get started

AI coding agents

Let Claude Code, Cursor and other agents protect keys without ever seeing them.

Vallkey has an MCP server, so AI coding agents such as Claude Code, Cursor and Windsurf can protect and manage keys for you. The agent never sees a real key: to protect one, it names the .env file and the variable, and the server on your computer reads the key, creates the ghost key and writes it back. Only the key id goes back to the agent.

Claude CodeShell

npx vallkey loginclaude mcp add vallkey -- npx -y vallkey mcp

Cursor, Windsurf and other MCP clientsJSON

1{2  "mcpServers": {3    "vallkey": { "command": "npx", "args": ["-y", "vallkey", "mcp"] }4  }5}

Tool	What it does
`scan_project`	Finds API keys in the project and .env files, masked.
`protect_env_key`	Swaps a key in a .env file for a ghost key, and adds the base URL where the SDK reads one.
`list_keys, get_key`	Lists your ghost keys, and shows one key's rules and status.
`get_activity`	Recent requests, with the reason for each refused one. Agents use it to fix failing calls.
`list_providers`	The services Vallkey knows, with their default rules.
`update_rules`	Changes some rules. Looser rules still wait for the safety delay.
`list_real_keys, create_ghost_key`	Lists real keys shared by several ghost keys, and makes another ghost key for one, inside its outer rules.
`kill_key`	Stops a key right away. Reviving it is left to a person, in the dashboard.

The server uses the sign-in from npx vallkey login, or an API token in VALLKEY_TOKEN. Your MCP client asks before each tool runs, and every action is in your audit log.

Still have a question?

We read every email, usually within a day.

Contact support