Local KMS MCP Server

Local-first, lightweight MCP server for per-agent key management.

Local serverstdioTypeScript

What is the Local KMS MCP Server?

Local-first, lightweight MCP server for per-agent key management.

What you get

  • Generates signing keypairs scoped to a keyId (one identity per agent or task)
  • Stores keys locally using a simple file-based keystore
  • Rotates keys safely while preserving algorithm consistency
  • Signs base64 payloads without ever exposing private key material
  • Optionally encrypts keys at rest using AES-256-GCM
  • Runs over MCP via stdio (default) or HTTP when needed

Configuration and credentials

  • Node.js >=24.0.0 - An MCP client that supports stdio or HTTP MCP servers

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

ToolWhat it does
check_keypairCheck whether a key exists
list_keysList all stored key IDs
list_algorithmsList all supported signing algorithms
generate_keyCreate and persist a new keypair
get_key_infoReturn the stored public key for a key ID
rotate_keyRotate an existing keypair using its stored algorithm
delete_keyDelete a keypair with optional secure wipe
sign_messageSign a base64-encoded payload

How to install the Local KMS MCP Server

{
  "mcpServers": {
    "local-kms": {
      "command": "npx",
      "args": [
        "-y",
        "local-kms-mcp-server"
      ],
      "env": {
        "STORE_PATH": "/Users/yourname/.local-kms",
        "ENCRYPT_STORE": "true",
        "STORE_ENCRYPTION_KEY": "YOUR_STORE_ENCRYPTION_KEY"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

  • Node.js >=24.0.0 - An MCP client that supports stdio or HTTP MCP servers
VariableDescriptionRequired
STORE_PATHDeclared in the maintainer’s client configuration.Check documentation
ENCRYPT_STOREDeclared in the maintainer’s client configuration.Check documentation
STORE_ENCRYPTION_KEYDeclared in the maintainer’s client configuration.Yes

Frequently asked questions

Local-first, lightweight MCP server for per-agent key management. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.