Secrets Router

秘密路由器

MCP服务器，用于代理工作流中的凭据隔离。

问题： 人工智能代理需要将密码、卡号和API密钥填充到浏览器和API中。如果代理看到该值，它将进入上下文窗口，并可能记录日志、工具调用或对话历史。secrets路由器将凭据值保存在服务器进程中——代理只看到不透明的句柄和屏蔽的预览。

encrypted store ──> secrets-router ──> browser/API
                         |
                    agent sees only:
                    handle:a3f8c2d1...
                    ****1017

快速开始

# Install
pip install -e .

# Register with Claude Code
claude mcp add secrets-router -- python3 /path/to/secrets-router/server.py

需求

• Python 3.11+
• 浏览器填充：Chromium运行 --remote-debugging-port （参见 CDP设置)

工具

凭证后端

运作原理

1. Agent calls: secure_fetch("rbw", "primary card", "number")
   Agent receives: {"handle": "handle:a3f8c2d1...", "masked": "****1017"}

2. Agent calls: secure_fill("handle:a3f8c2d1...", "#card-number")
   Server resolves handle -> fills browser DOM via CDP WebSocket
   Agent receives: {"status": "filled", "masked": "****1017"}
   Handle is consumed (single-use) and deleted.

3. The card number never entered the agent's context.

食谱

食谱是定义具有凭证隔离的多步骤工作流的YAML文件。代理调用一个工具并返回感知（发生了什么），而看不到任何凭据值。

# List available recipes
secure_list_recipes()

# Run a recipe
secure_run_recipe("pay-water-milwaukee")

# Dry run (shows steps without executing)
secure_run_recipe("pay-water-milwaukee", dry_run=True)

# Override config values
secure_run_recipe("pay-water-milwaukee", config_overrides={"account_number": "9999"})

看 recipes/README.md 获取完整的食谱语言参考。

CDP设置

secrets路由器通过Chrome DevTools协议填充浏览器字段。浏览器必须在启用远程调试的情况下运行：

# Launch Chromium with CDP
chromium --remote-debugging-port=9222

# Or with Google Chrome
google-chrome --remote-debugging-port=9222

# secrets-router auto-discovers the CDP port from running processes.
# No configuration needed if Chromium is running with the flag above.

安全模型

• 手柄为一次性使用 5分钟后过期（可配置）
• 值保持在进程中 --使用后立即取消引用
• 屏蔽输出 仅显示最后4个字符(****1017)
• 审批门 在配方中暂停执行以进行人工/代理审查
• 日志中没有值 --只记录句柄ID和源名称

局限性

• Python字符串是不可变的，并且是垃圾回收的。值不能加密为零。它们在使用后会被取消引用（不是内存集）。
• 隔离边界是进程级的，而不是网络级的。如果服务器进程受到损害，值就会暴露出来。

项目结构

secrets-router/
  server.py                  MCP tools + handle store + credential backends
  engine.py                  Recipe execution engine
  actuators/
    base.py                  Abstract actuator interface
    playwright_cdp.py        Browser automation via CDP
  recipes/
    schema.yaml              Recipe language spec
    README.md                Action reference
    pay-water-milwaukee.yaml Example: utility bill payment
    example-login-github.yaml    Example: GitHub login with 2FA
    example-api-call.yaml        Example: authenticated API call
    example-template.yaml        Blank template for new recipes
  precepts/
    generate.py              Scan vault, generate credential inventory
  skills/
    secrets-router.md        Record/play/list/edit recipes (progressive disclosure)
    route-validator.md       Validate recipe before running (credentials, URLs, selectors)
    recipe-debugger.md       Diagnose failed recipe execution
    recipe-tester.md         Dry-run trace without execution
    step-recorder.md         Watch browser actions → auto-generate recipe YAML
    credential-auditor.md    Audit credential usage across recipes

技能（克劳德代码）

回购附带六项技能。复制到 ~/.claude/skills/ 或直接使用。

# Install skills
cp skills/*.md ~/.claude/skills/

# Use in Claude Code
/secrets-router record "pay electric bill"
/secrets-router play pay-water-milwaukee
/route-validator recipes/pay-water-milwaukee.yaml
/recipe-tester pay-water-milwaukee
/credential-auditor

CLI使用情况

# Start the MCP server
python3 server.py

# Standalone: list recipes
python3 -c "from engine import RecipeEngine; e = RecipeEngine('recipes'); print([r['name'] for r in e.list_recipes()])"

# Standalone: load and check a recipe
python3 -c "from engine import RecipeEngine; e = RecipeEngine('recipes'); print(e.load_recipe('pay-water-milwaukee')['name'])"

# Scan vault inventory (local only, not exposed to agents)
python3 precepts/generate.py

许可证

麻省理工学院