秘密路由器
MCP服务器，用于代理工作流中的凭据隔离。
问题： 人工智能代理需要将密码、卡号和API密钥填充到浏览器和API中。如果代理看到该值，它将进入上下文窗口，并可能记录日志、工具调用或对话历史。secrets路由器将凭据值保存在服务器进程中——代理只看到不透明的句柄和屏蔽的预览。
encrypted store ──> secrets-router ──> browser/API
|
agent sees only:
handle:a3f8c2d1...
****1017快速开始
# Install
pip install -e .
# Register with Claude Code
claude mcp add secrets-router -- python3 /path/to/secrets-router/server.py需求
- Python 3.11+
- 浏览器填充：Chromium运行
--remote-debugging-port（参见 CDP设置)
工具
| 工具 | 它做什么 | 代理看到 |
|---|---|---|
secure_fetch(store, key, field) | 获取凭证，返回不透明句柄 | handle:a3f8c2d1... + ****1017 |
secure_fill(handle, selector) | 通过CDP填写浏览器字段 | {"status": "filled", "masked": "****1017"} |
secure_list_handles() | 列出活动句柄 | ID、来源、年龄--无值 |
secure_discard_handles(handle?) | 提前放下手柄 | 计数丢弃 |
secure_list_recipes() | 列出可用的YAML配方 | 名称、描述、标签 |
secure_run_recipe(name, ...) | 执行完整的食谱 | 逐步感知，蒙面 |
凭证后端
| 后端 | CLI工具 | 示例 |
|---|---|---|
rbw | RBW | secure_fetch("rbw", "primary card", "number") |
bitwarden | 带宽 | secure_fetch("bitwarden", "my-login", "password") |
pass | 通过 | secure_fetch("pass", "payments/card") |
yaml | 年龄 | secure_fetch("yaml", "water-bill.card.number") |
env | -- | secure_fetch("env", "API_KEY") |
运作原理
1. Agent calls: secure_fetch("rbw", "primary card", "number")
Agent receives: {"handle": "handle:a3f8c2d1...", "masked": "****1017"}
2. Agent calls: secure_fill("handle:a3f8c2d1...", "#card-number")
Server resolves handle -> fills browser DOM via CDP WebSocket
Agent receives: {"status": "filled", "masked": "****1017"}
Handle is consumed (single-use) and deleted.
3. The card number never entered the agent's context.食谱
食谱是定义具有凭证隔离的多步骤工作流的YAML文件。代理调用一个工具并返回感知（发生了什么），而看不到任何凭据值。
# List available recipes
secure_list_recipes()
# Run a recipe
secure_run_recipe("pay-water-milwaukee")
# Dry run (shows steps without executing)
secure_run_recipe("pay-water-milwaukee", dry_run=True)
# Override config values
secure_run_recipe("pay-water-milwaukee", config_overrides={"account_number": "9999"})看 recipes/README.md 获取完整的食谱语言参考。
CDP设置
secrets路由器通过Chrome DevTools协议填充浏览器字段。浏览器必须在启用远程调试的情况下运行：
# Launch Chromium with CDP
chromium --remote-debugging-port=9222
# Or with Google Chrome
google-chrome --remote-debugging-port=9222
# secrets-router auto-discovers the CDP port from running processes.
# No configuration needed if Chromium is running with the flag above.安全模型
- 手柄为一次性使用 5分钟后过期（可配置）
- 值保持在进程中 --使用后立即取消引用
- 屏蔽输出 仅显示最后4个字符(
****1017) - 审批门 在配方中暂停执行以进行人工/代理审查
- 日志中没有值 --只记录句柄ID和源名称
局限性
- Python字符串是不可变的，并且是垃圾回收的。值不能加密为零。它们在使用后会被取消引用（不是内存集）。
- 隔离边界是进程级的，而不是网络级的。如果服务器进程受到损害，值就会暴露出来。
项目结构
secrets-router/
server.py MCP tools + handle store + credential backends
engine.py Recipe execution engine
actuators/
base.py Abstract actuator interface
playwright_cdp.py Browser automation via CDP
recipes/
schema.yaml Recipe language spec
README.md Action reference
pay-water-milwaukee.yaml Example: utility bill payment
example-login-github.yaml Example: GitHub login with 2FA
example-api-call.yaml Example: authenticated API call
example-template.yaml Blank template for new recipes
precepts/
generate.py Scan vault, generate credential inventory
skills/
secrets-router.md Record/play/list/edit recipes (progressive disclosure)
route-validator.md Validate recipe before running (credentials, URLs, selectors)
recipe-debugger.md Diagnose failed recipe execution
recipe-tester.md Dry-run trace without execution
step-recorder.md Watch browser actions → auto-generate recipe YAML
credential-auditor.md Audit credential usage across recipes技能（克劳德代码）
回购附带六项技能。复制到 ~/.claude/skills/ 或直接使用。
| 技能 | 它做什么 |
|---|---|
secrets-router | 手动记录工作流→ 生成配方→ 自主回放 |
route-validator | 飞行前检查：凭据存在，URL可访问，选择器有效 |
recipe-debugger | 故障后诊断：哪个步骤坏了，为什么，建议修复 |
recipe-tester | 模拟运行跟踪：在不执行的情况下验证每个步骤 |
step-recorder | 观看剧作家的动作→ 自动生成配方步骤 |
credential-auditor | 跨配方审核：已使用/缺失/未使用的凭据 |
# Install skills
cp skills/*.md ~/.claude/skills/
# Use in Claude Code
/secrets-router record "pay electric bill"
/secrets-router play pay-water-milwaukee
/route-validator recipes/pay-water-milwaukee.yaml
/recipe-tester pay-water-milwaukee
/credential-auditorCLI使用情况
# Start the MCP server
python3 server.py
# Standalone: list recipes
python3 -c "from engine import RecipeEngine; e = RecipeEngine('recipes'); print([r['name'] for r in e.list_recipes()])"
# Standalone: load and check a recipe
python3 -c "from engine import RecipeEngine; e = RecipeEngine('recipes'); print(e.load_recipe('pay-water-milwaukee')['name'])"
# Scan vault inventory (local only, not exposed to agents)
python3 precepts/generate.py许可证
麻省理工学院