Enpass MCP

Runs locally over stdio. Your Enpass vault never leaves your machine, and yourmaster password never passes through the model: it is stored in your operating system's keychain and read directly by the server.

Entry passwords are, by design, returned to the assistant when you ask for them, so only connect this to an assistant and vaults you trust.

- Node.js 18 or newer
- An Enpass 6 / 7 / 8 vault (vault.enpassdb, SQLCipher format)
- On Linux: a Secret Service provider (GNOME Keyring or KWallet) for password storage

Native dependencies (better-sqlite3-multiple-ciphers,@napi-rs/keyring) ship prebuilt binaries for common platforms, so no compiler is required in the normal case.

git clone https://github.com/bitterdev/enpass-mcp.git cd enpass-mcp npm install npm link # optional: makes the enpass-mcp command available globally

Register your vaults (do this once, in a terminal)

This is the secure step that keeps the master password away from the model. You run it yourself; the password is typed into a hidden prompt and stored in the OS keychain.

# Find your vault files automatically enpass-mcp discover # Register a vault (you will be prompted for the master password) enpass-mcp add-vault personal --path "/Users/you/Documents/Enpass/Vaults/primary/vault.enpassdb" enpass-mcp add-vault work --path "/path/to/work/vault.enpassdb" # With a keyfile enpass-mcp add-vault personal --path "/path/vault.enpassdb" --keyfile "/path/vault.keyfile" # Manage enpass-mcp list-vaults enpass-mcp test-unlock personal enpass-mcp remove-vault work

add-vaultverifies the password can actually unlock the vault before saving it.

If you sync via Dropbox / OneDrive / WebDAV, point--pathat the synced copy.

The server speaks MCP over stdio. Point your MCP client atenpass-mcp serve.

Claude Desktop(claude_desktop_config.json):

list_items/get_itemwork foreveryEnpass entry type (logins, credit cards, secure notes, identities, etc.), not just logins, and return all fields.

A typical assistant flow:list_vaults→unlock_vault→list_items→get_password.

Enpass stores each vault as a standard SQLCipher database (vault.enpassdb). The raw encryption key is derived from your master password (optionally combined with a keyfile) and the 16-byte salt at the start of the file:

- PBKDF2-HMAC-SHA512, 100000 iterations (older vaults) or 320000 (newer vaults), the first 32 bytes used as the raw SQLCipher key
- opened withcipher_compatibility4 (Enpass 6.8+) or 3 (older vaults)

The server tries these combinations automatically, so it works across Enpass vault versions. The derived key is kept in memory only, for the lifetime of the server process, and is never written to disk or returned to the model.

Enpass encrypts every value flagged as "sensitive" a second time, underneath SQLCipher, with a key that belongs to the entry rather than the vault. Fields carrying that layer haveitemfield.algo_version = 1:

Binding the AAD to the entry uuid is what makes a value unusable if it is copied into another entry. Enpass didnotre-encrypt existing entries when it introduced this layer, so one vault mixes ciphertext and plaintext under the samealgo_version; a value is treated as encrypted only when it has the shape of a payload (pure hex, whole bytes, longer than the tag on its own).

A value that looks encrypted but fails authentication is returned asnullwithdecryptionFailed: true, never as the raw column content: stored ciphertext is a plausible-looking string, and handing that back would silently pass off a wrong secret as a real one.

Entries with a one-time-password secret (stored by Enpass as anotpauth://URI) can produce a live 2FA code:get_otpreturns the current 6-digit code and the seconds until it rotates, andget_passwordincludes the current code alongside the password. This lets an assistant fill both the password and the 2FA prompt.

Enpass keeps file attachments encrypted. Small files (up to 1 KB) sit inline in the vault; larger files live in separate<uuid>.enpassattachSQLCipher files next to the vault, each encrypted with its own key stored in the vault.export_attachmenthandles both: it decrypts the file and, by default, writes it to disk and returns the path, so it works for files of any size without pushing binary data through the model.

External-attachment handling is implemented from Enpass's documented format. If you hit a vault whose attachments do not decrypt, please open an issue with the (non-secret) schema of yourattachmenttable.

Writing is switched off by default. A password vault is the last place where a tool should be able to change data just because a model decided to, so the server starts read-only and does not even listcreate_item,delete_itemandsync_pulluntil you turn them on:

Set it in the server's environment (in your MCP client config, or in the.envnext tovaults.json). Nothing else changes: reading works exactly the same either way.

Enpass must be closed while writing.The app keeps the database in memory and would write its own cached copy back over any change made underneath it. Every writing tool refuses to run while Enpass is open.

Earlier versions of this README claimed writing was impossible because recent vaults (schema version 6) crash Enpass when entries are inserted directly. The crash was real, the diagnosis was wrong. Three concrete rules make it work, all of them derived from what Enpass itself writes:
- Enpass never storesNULL.The crash isEXC_BAD_ACCESSinstrlenon a null pointer: a column omitted from theINSERTdefaults toNULL, and the app callsstrlenon it. Every column is written explicitly, empty strings instead ofNULL.
- A template has a fixed field set.login.defaultalways carries the same nine fields, in the same order, with the same field uids, even when most are empty. Writing only the fields you happen to have a value for produces an entry the app cannot render.
- The per-item key is reproducible.item.keyis a 32-byte AES-256 key plus a 12-byte GCM nonce, stored ashex(ciphertext || tag)with the item UUID as additional authenticated data. Nothing in it is tied to Enpass internals, so a fresh random key per item is fine.

Verified end to end against a real vault: written, read back, decrypted to the original, deleted, synced in both directions, and Enpass opens the vault without crashing.

Master passwords are in the OS keychain; only non-secret data (vault names and paths) is stored in a smallvaults.json:

- macOS:~/Library/Application Support/enpass-mcp/vaults.json
- Windows:%APPDATA%\enpass-mcp\vaults.json
- Linux:~/.config/enpass-mcp/vaults.json

Override the directory withENPASS_MCP_CONFIG_DIR.

npm test # runs against genuine SQLCipher fixtures in test/fixtures # Rebuild the fixtures from scratch with real SQLCipher (vault + entries + attachments) npm install --no-save @journeyapps/sqlcipher npm run generate-fixtures

CI (GitHub Actions) creates a vault from scratch with real SQLCipher, seeds entries and attachments, then runs the full read-only test suite on Node 18/20/22.

Transaction-complete hotel booking over MCP — 300K+ properties, real hotel confirmation numbers, loyalty points, secure checkout. Hotels are merchant of record. Builders set their own booking fee via Stripe Connect. Built on proven distribution infrastructure.

An MCP server for AI video generation. MCP server for AI video generation. Lets Claude, ChatGPT, OpenClaw , Hermes & other agents create AI videos and publish them to YouTube, TikTok, Instagram etc..

Institutional research and manager diligence reports on hedge funds, venture capital and private equity managers. Summary of filings, personnel changes, media screening and social signals delivered to you in minutes.

ALTER - identity infrastructure for the AI economy

D2C eCommerce fulfillment platform: manage orders, inventory, shipments, campaigns, and billing via AI agents

Apigene MCP Gateway is the runtime layer that connects AI agents to APIs and MCP servers via Model Context Protocol.

MCP to interface with multiple blockchains, staking, DeFi, swap, bridging, wallet management, DCA, Limit Orders, Coin Lookup, Tracking and more.

MCP server for Bitnovo Pay integration with AI agents. Provides cryptocurrency payment capabilities through Bitnovo Pay API. Features include payment creation, status checking, QR code generation, and webhook management with support for multiple tunnel providers (ngrok, zrok, manual).

Shop for gift cards, esims, phone topups. Pay with cards and crypto.