Maintainer of this skill?
Automated security scan — not a certification.
OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaintext out of model context by default.
# Add to your Claude Code skills
git clone https://github.com/omaekumiko2-create/OpenKeyletLast scanned: 10/27/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-10-27T09:38:28.310Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how OpenKeylet compares with popular alternatives.
OpenKeylet is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by omaekumiko2-create. OpenKeylet — Local password and credential manager for AI agents via MCP. Use passwords, API keys, SSH, and TOTP while keeping hidden plaintext out of model context by default. It has 131 GitHub stars.
Yes. OpenKeylet passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/omaekumiko2-create/OpenKeylet" and add it to your Claude Code skills directory (see the Installation section above).
OpenKeylet is primarily written in Rust. It is open-source under omaekumiko2-create on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh OpenKeylet against similar tools.
No comments yet. Be the first to share your thoughts!
30 days in the Featured rail · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
OpenKeylet is a free, open-source, cross-platform password manager, credential vault, and local stdio MCP server for AI agents. It lets MCP clients such as Codex, Claude Code, Cursor, OpenCode, and OpenClaw use saved passwords, API credentials, SSH keys, TOTP codes, and custom secrets while hidden plaintext stays outside the normal model context.
Use OpenKeylet when an agent needs to sign in to a website, connect to a server, call an authenticated API, or finish a terminal prompt without asking you to paste a secret into the conversation.
Previously KRU. OpenKeylet keeps the same local vault, encryption keys, browser pairing, and .mvault backup format. Existing {{kru:module}} placeholders and KRU_DATA_DIR / KRU_LAUNCHER_PATH environment variables remain supported; use {{openkeylet:module}} and OPENKEYLET_* for new setups. After upgrading, open Settings → Agent connection → Repair to migrate a managed kru MCP entry to openkeylet and update its executable path, then start a new agent session. Existing desktop and startup shortcuts are migrated when the new GUI starts.
Once OpenKeylet is connected, describe the task normally. Include the unique OpenKeylet item name for the most reliable match, or simply tell the agent to check OpenKeylet when authentication is needed.
| Goal | Example |
|---|---|
| Server task | Use "Production Server" in OpenKeylet MCP to deploy the current build and verify the service. |
| Authenticated API | Use "DNS Provider" in OpenKeylet MCP to list the domains in this account. |
| Browser sign-in | Open the admin console. When credentials are required, use "Admin Account" in OpenKeylet MCP. |
| Automatic lookup | Continue the task. If authentication is required, check OpenKeylet first. |
The quoted text is the item name saved in OpenKeylet. If you omit it, the agent can inspect OpenKeylet's item list and choose a match.
OpenKeylet is a small local MCP tool for saving and using credentials without breaking an agent's workflow. The agent controls the task, while OpenKeylet performs credential operations locally—filling a focused field, running local or SSH commands, transferring files and directories, or sending authenticated API requests.
The personal vault supports logins, cards, identities, secure notes, SSH, API and custom items, with type filters, folders and favorites. Fields remain composable. Passwords, card numbers, security codes, identity addresses and secure notes are encrypted; names, public purposes and folders remain item metadata.
The browser extension can create, edit and manually fill cards and identities from the same local vault. Autofill supports standard HTML autocomplete, common field names and labels, month controls, expiry formats and select options on HTTPS websites or local development addresses. It skips hidden/transparent, disabled and readonly fields; when a relevant form is focused, it fills only that form. It never submits a form or fills a different-origin frame. Lists expose only a card's last four digits. Custom payment widgets and third-party payment frames may require manual filling.
Desktop and extension password generators use the system secure random source, with 8–128 characters and selectable uppercase, lowercase, digits and symbols. Generated passwords are not retained in history.
The extension's All vault items panel works on browser pages as well as websites. Search and filter the full vault, edit login URLs and matching rules, organize folders and favorites, and manage cards, identities and notes. Deletion moves an item to Trash, where it stays until restored or permanently deleted. Trashed items cannot fill passwords or sign with passkeys. Restoring a conflicting name creates a unique name without overwriting another item.
Changing a saved password retains the latest 20 previous passwords in encrypted Password history. Desktop and extension views can reveal, copy or clear this history after unlocking; agents and autofill cannot request old passwords. Full vault backups include history and trash. Permanent deletion and history clearing do not remove older copies from existing backups.
There is no OpenKeylet account, subscription, hosted vault, or remote MCP service. OpenKeylet is free and open source, runs on Windows, macOS, and Linux, and keeps vault data encrypted on the current device. Optional GitHub backup stores encrypted snapshots in your own private repository. Its local stdio MCP starts only when an agent calls it.
Download and open OpenKeylet Choose the portable build for your platform. No registration is required.
Connect your agent Open Settings → Agent connection, connect a detected client, then start a new agent session.
Save an item Give it a unique name and add only the modules you need. You can start from a preset or build the item module by module.
OpenKeylet registers a local stdio MCP command. The MCP process starts on demand when the agent calls it.
OpenKeylet's Agent connection screen can detect, connect, and repair local configuration for Codex, Claude Code, Cursor, OpenCode, and OpenClaw. Other AI assistants and coding agents can connect through the manual configuration below whenever they support a local stdio MCP server.
| Action | When OpenKeylet advertises it | What happens locally |
|---|---|---|
| Fill | The item contains a credential module | OpenKeylet writes the selected value into a focused browser, desktop control, or managed terminal |
| SSH | The item contains a password or private key | OpenKeylet authenticates locally; the host, port, and username can be saved defaults or supplied for the task |
| File transfer | The item contains a password or private key | OpenKeylet recursively uploads or downloads files and directories over SFTP |
| HTTP | The item contains any configured secret | OpenKeylet injects built-in authentication or resolves hidden-module placeholders locally |
| Terminal | The agent runs a local command or opens a managed terminal | OpenKeylet can substitute hidden modules without returning them to the agent |
An item may advertise more than one action. OpenKeylet has no observation, diagnostic, restricted, or execution mode: if ssh_run is available, the agent sends the command the task actually requires.
Every module has its own Agent visibility switch:
The eye and copy controls in the editor are for the local owner. The optional six-digit PIN protects GUI plaintext viewing and extension vault access, and verifies each passkey operation. It does not replace vault encryption or disable MCP actions.
Reorder modules using the drag handle on the left, or focus a handle and press the Up/Down arrow keys. Text fields support normal typing, selection, and copying. Deleting an item, module, or draft requires confirmation; module removal takes effect when you save the item.
The bundled Chromium extension shares the desktop application's local encrypted vault. In Settings → Browser Bridge, follow the two numbered steps: 1. Open the extensions page and turn on Developer mode; 2. Drag in the extension by dropping the OpenKeylet icon onto an empty area of that page. If the page does not open automatically, enter chrome://extensions in Chrome's address bar. The Can't install by dragging? section offers a folder button for Load unpacked. Keep the browser-extension directory in pl