Phantom Secrets MCP Server

Phantom hands every AI tool a worthless phm_ token. The local proxy injects the real key at the network layer. Full access. Zero exposure. Exposed over MCP by the phantom secrets mcp server, that capability becomes something an assistant can invoke while it works, not something you go and do afterwards.

What it actually does

• 🔒 Real keys never enter the LLM — .env contains only phm_ tokens; the proxy swaps them at the network edge
• ⚡ 10-second setup — npx phantom-secrets init and you're protected. No accounts, no DNS, no MITM cert dance
• 🧰 Works with every AI tool — Claude Code, Cursor, Windsurf, Codex, GitHub Copilot. Anything that reads .env
• 🦀 Open source, local-first, MIT — your secrets live in your OS keychain. The optional cloud sync is end-to-end encrypted; the server only ever sees ciphertext

Its toolset

Everything the assistant can do here goes through one of these:

• Windows-on — ARM64 not yet packaged — x64 only. Tracker: #1
• Vault — phantom_list_secrets, phantom_status, phantom_init, phantom_add_secret_interactive, phantom_add_secret (deprecated; refuses plaintext)
• Local-to-cloud — phantom_wrap, phantom_unwrap, phantom_sync, phantom_cloud_push, phantom_cloud_pull, phantom_cloud_status
• Teams — phantom_team_list, phantom_team_create, phantom_team_members, phantom_team_invite, phantom_team_key_publish, phantom_team_vault_push
• Pre — commit hook** -- Blocks commits containing unprotected secrets
• Tamper — evident audit log** -- PHANTOM_AUDIT=1 writes vault events as JSONL to ~/.phantom/audit.log. Each entry is chained with HMAC-SHA256; phantom audit
• Multi — project scanner** -- phantom init --all protects every git repo with a .env under in one command (with --dry-run); --jobs N controls
• Cross — project copy** -- phantom copy shares secrets between project vaults
• Built — in service routing** -- OpenAI, Anthropic, Stripe, Supabase, and custom services via .phantom.toml
• ChaCha20 — Poly1305** encryption for file vault and cloud sync, Argon2id key derivation
• Zero — knowledge cloud** -- server stores only ciphertext; encryption key never leaves the client
• Crate — Role

Configuration

You will need 4 environment variables: OPENAI_BASE_URL, PHANTOM_PROXY_TOKEN, OPENAI_API_KEY, STRIPE_KEY. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Adding it to your client

The server ships on npm as phantom-secrets, so your MCP client can launch it on demand — there is no separate build step. Add the server block to your client's configuration, restart it, and the tools register themselves.

When to reach for it

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Phantom Secrets's toolset — Windows-on, Vault, Local-to-cloud and 11 more — is a fair guide to whether it matches your workflow. It is maintained by ashlrai; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Phantom Secrets.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the phantom secrets mcp server does with a few real requests.