Agentkms, developed by Thegenxcoder for the mcp platform, is a free MCP server designed to manage and mint short-lived credentials for AI agents. It acts as a sovereign secrets infrastructure, centralizing credential and secrets management for the AI agent era. This tool helps secure agentic workflows by connecting to upstream provider APIs like GitHub and AWS STS. Agentkms ensures AI agents receive temporary, scoped access, enhancing security and policy enforcement for external service interactions.

What does Agentkms connect to?

Agentkms connects to various upstream provider APIs to manage credentials. These include services such as GitHub and AWS STS (Security Token Service). It establishes these connections to mint short-lived credentials for AI agents, operating as a crucial component in sovereign secrets infrastructure. The server handles credential and secrets management, ensuring secure interactions between AI agents and external services by acting as an intermediary for access requests. It maintains one privileged admin credential per provider internally.

Core features and tools

Agentkms exposes specific callable tools via its MCP interface. Agents can use get_credential(name) to retrieve a short-lived token based on a specified credential name. Another available tool is list_providers(), which allows agents to enumerate the configured and available providers within Agentkms. These tools enable AI clients to request and manage access to external services without directly handling long-lived master keys, supporting secure and policy-driven access.

Who is it for?

Agentkms is intended for developers and organizations that build and deploy AI agents, especially those prioritizing the security of agentic workflows. It serves as a central point for managing AI agent access to various resources and enforcing policies. This allows for better control over how agents interact with external services and helps prevent direct exposure of sensitive, long-lived credentials. Skip this if your AI agent workflows do not require managing temporary, scoped credentials for external services.

How to get started

No credentials are required. It communicates via stdin and SSE (Server-Sent Events) over HTTP.

Use cases

• Securely provide AI agents with temporary, scoped credentials for external services (e.g., GitHub, AWS), avoiding long-lived master keys.
• Centralize policy enforcement for AI agent access to resources, shifting policy management to Agentkms.
• Enable rapid response to credential leaks, as minted tokens are short-lived and quickly expire or revoke.

Agentkms by Thegenxcoder offers a specialized solution for securing AI agent interactions with external services, acting as a central secrets manager. It issues short-lived, scoped credentials, reducing the risk associated with long-lived keys and centralizing access policies. This MCP server supports a policy-driven approach to agent access, enhancing security for AI agent deployments.