Case Study

Keyblind

How IntellectAI built an encrypted secrets vault with MCP integration for AI agents — protecting API keys from leaking to LLM conversations across every major AI editor.

DevToolsSecurityMCP-NativeLive at keyblind.dev
40+
CLI Commands
16
MCP Tools
MIT
License
Zero
Telemetry

The Problem

AI coding tools are everywhere — and they're leaking secrets at an alarming rate:

  • 100,000+ LLM conversations with exposed API keys were found indexed by search engines in 2025
  • AI agents read .env files and copy-paste plaintext secrets into conversations — invisible to the developer
  • Existing secret managers weren't built for the AI era — no MCP integration, no sandboxing, no agent awareness
  • VS Code / Cursor-only solutions left developers using other AI editors completely unprotected
  • Teams lacked a way to share secrets without copy-pasting them through Slack, email, or shared .env files

The Solution: Keyblind

A developer-first, MCP-native encrypted secrets vault. Secrets are resolved at runtime and never appear in LLM conversation transcripts. Works with every major AI editor, every major backend, and any CI/CD pipeline.

Encrypted Secrets Vault

AES-256-GCM encrypted SQLite vault with PBKDF2 key derivation. Machine-identity-bound encryption keys mean secrets are tied to the device. Zero network, zero telemetry, fully local.

MCP-Native AI Agent Integration

16 MCP tools that work with every MCP-compatible AI editor — Claude Code, Cursor, Copilot, Windsurf, Cline, Zed. Secrets are resolved at runtime, plaintext never appears in the LLM conversation transcript.

Sandbox Mode

Replaces real .env values with deterministic HMAC-SHA256 fakes. AI agents reading .env files see only fakes. When you run your app, real secrets are injected as environment variables at runtime.

Multi-Backend Support

Works with 7 backends: local encrypted vault, 1Password CLI, Bitwarden CLI, environment variables, AWS Secrets Manager, GCP Secret Manager, and Azure Key Vault. One interface, any backend.

Browser Extension

Chrome MV3 extension that detects 13+ API key formats in real-time. Intercepts paste events on AI chat sites (Claude.ai, ChatGPT, Copilot) and shows warning banners before secrets leak.

Dead Man's Switch & Secret Sharing

End-to-end encrypted secret sharing via URL fragments — secrets are encrypted client-side and never touch a server. Dead man's switch auto-releases vault access to designated contacts after inactivity.

CI/CD Integration

GitHub Action injects secrets as masked environment variables in CI/CD pipelines. Pre-commit hook scans staged files for exposed secrets and blocks commits before they leave the machine.

TOTP 2FA Built In

Built-in TOTP code generator with 30-second rotation. Store TOTP configs alongside your secrets and generate codes directly from the CLI — no phone needed.

Tech Stack

RuntimeNode.js, TypeScript (ESM)
EncryptionAES-256-GCM, PBKDF2 (600K iterations)
StorageSQLite (better-sqlite3)
MCP@modelcontextprotocol/sdk — stdio + Streamable HTTP
DashboardNext.js 15, React 19, Tailwind CSS, lucide-react
PaymentsStripe (license keys, checkout)
EmailResend (transactional)
Distributionnpm registry, Smithery, Glama, Homebrew
CI/CDGitHub Actions, pre-commit hooks

Build Process

1

Core Vault Engine

Phase 1

  • AES-256-GCM encryption with PBKDF2 key derivation (600K iterations)
  • Machine-identity-bound encryption keys via XOR-wrapped machine fingerprint
  • SQLite storage layer with parameterized queries and prepared statements
  • Zero network, zero telemetry architecture — fully local by design
2

MCP Server + CLI

Phase 2

  • Built 16 MCP tools for secret resolution, storage, listing, and deletion
  • 40+ CLI commands covering vault ops, sandbox, TOTP, sharing, and team management
  • Sandbox mode: HMAC-SHA256 deterministic fakes with runtime secret injection
  • Multi-backend provider system with unified interface across 7 backends
3

Dashboard + Browser Extension

Phase 3

  • Next.js dashboard for secret management, audit logs, and license management
  • Chrome MV3 browser extension with 13+ API key format detection
  • Paste interception on AI chat sites with warning banners
  • CLI-to-dashboard pairing via license key or one-time token
4

Launch & Distribution

Phase 4

  • Published to npm registry with automated CI/CD via GitHub Actions
  • Listed on MCP marketplaces: Smithery and Glama
  • Homebrew formula for macOS one-command install
  • Stripe integration for Pro and Team license sales

Key Takeaway

Keyblind proves that developer tools with MCP-first integration can capture a growing market of AI-assisted developers who need security built into their workflow, not bolted on after. The same MCP-native approach applies to any developer tool facing the explosion of AI coding assistants.

Need a Developer Tool or AI Product?

We build MCP-native developer tools, AI-powered platforms, and full-stack products. Start with a free consultation.

Book Your Free AI Audit

Or visit keyblind.dev to try Keyblind.