Kru
Local-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TOTP without exposing hidden plaintext to the model.
- Transport
- Not stated
- Package
- —
- Registry id
- —
No install snippet on purpose. A working MCP config is a command, its arguments and an environment block — the last two are where API keys live, so this catalogue never stores them and cannot publish them. Follow the link above for the authors' own instructions.
Local only · Free and open source · No account · Windows / macOS / Linux
KRU is a free, open-source, cross-platform password manager, credential vault, and local stdio MCP server for AI agents. It lets MCP clients such as Codex, Claude Code, Cursor, OpenCode, and OpenClaw use saved passwords, API credentials, SSH keys, TOTP codes, and custom secrets while hidden plaintext stays outside the normal model context.
Use KRU when an agent needs to sign in to a website, connect to a server, call an authenticated API, or finish a terminal prompt without asking you to paste a secret into the conversation.
Use KRU like this
Once KRU is connected, describe the task normally. Include the unique KRU item name for the most reliable match, or simply tell the agent to check KRU when authentication is needed.
| Goal | Example |
|---|---|
| Server task | Use "Production Server" in KRU MCP to deploy the current build and verify the service. |
| Authenticated API | Use "DNS Provider" in KRU MCP to list the domains in this account. |
| Browser sign-in | Open the admin console. When credentials are required, use "Admin Account" in KRU MCP. |
| Automatic lookup | Continue the task. If authentication is required, check KRU first. |
The quoted text is the item name saved in KRU. If you omit it, the agent can inspect KRU's item list and choose a match.
What KRU does
KRU is a small local MCP tool for saving and using credentials without breaking an agent's workflow. The agent controls the task, while KRU performs credential operations locally—filling a focused field, running local or SSH commands, transferring files and directories, or sending authenticated API requests.
KRU stores credentials as independent modules rather than fixed “login / SSH / API” item types. Username, password, API credential, private key, key passphrase, TOTP, host, port, URL, and custom fields can be combined in one item. The available MCP actions are derived automatically from that combination.
There is no KRU account, subscription, cloud vault, or remote MCP service. KRU is free and open source, runs on Windows, macOS, and Linux, and keeps vault data encrypted on the current device. Its local stdio MCP starts only when an agent calls it.
| 01 / STORE Save only the modules the item needs. Values are encrypted locally. |
02 / DISCOVER The agent sees item names, field names, non-secret targets, and available actions. |
03 / USE KRU performs the selected credential action locally without returning hidden plaintext. |
Start in three steps
Download and open KRU Choose the portable build for your platform. No registration is required.
Connect your agent Open Settings → Agent connection, connect a detected client, then start a new agent session.
Save an item Give it a unique name and add only the modules you need. You can start from a preset or build the item module by module.
KRU registers a local stdio MCP command. The MCP process starts on demand when the agent calls it.
MCP client compatibility
From the project's README.