EnigmAgent

> Last week I asked Claude to push a fix to a private GitHub repo. To do that, Claude needed my personal access token. I had three options, and all three were terrible: paste the token into the chat (and into the provider's logs forever), give the agent a long-lived token it could reuse on its own at 3 a.m., or give up and do it by hand.

EnigmAgent is option four.

Your AI agent types `{{GITHUB_TOKEN}}`. The placeholder leaves the model and travels through the conversation, the logs, the context window — and only at the moment your tool actually needs the credential does EnigmAgent intercept the call, decrypt the real token locally with AES-256-GCM, and inject it. The plaintext exists for one event-loop tick. The model never sees it. The provider never sees it. Your terminal scrollback never sees it.

npx enigmagent-mcp --vault ./my.vault.json

That's the entire install for Claude Desktop, Cursor, Continue.dev, Cline, Open WebUI, AnythingLLM, and LM Studio. A separate browser extension covers everything that lives in a tab.

> ⭐ Star this repo if you've ever pasted a token you regretted.

30-second Claude Desktop setup

Add this to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):

{
  "mcpServers": {
    "enigmagent": {
      "command": "npx",
      "args": ["-y", "enigmagent-mcp", "--vault", "/absolute/path/to/my.vault.json"]
    }
  }
}

Restart Claude Desktop. Two new tools appear: `enigmagent_resolve` and `enigmagent_list`. Now ask Claude:

> *"List my vault entries, then call my GitHub API with `{{GITHUB_TOKEN}}` in the Authorization header."*

The real token never enters the conversation. Same pattern works for Cursor and Continue.dev below.

The problem (in detail)

When you use an AI agent — Claude, ChatGPT, Cursor, a browser automation tool — to do something that requires credentials, you face an impossible choice:

EnigmAgent is option D. The agent only ever types `{{GITHUB_TOKEN}}`. The real value never appears in the conversation, in logs, or in the agent's memory.

How it works

┌─────────────────┐   types {{GITHUB_TOKEN}}   ┌────────────────────┐
│   LLM / Agent   │ ──────────────────────────▶ │  Tool call / Form  │
│  (any provider) │                             │  (github.com / …)  │
└─────────────────┘                             └─────────┬──────────┘
                                                          │ submit / call (intercepted)
                                                          ▼
                                              ┌───────────────────────┐
                                              │      EnigmAgent       │
                                              │  detects placeholder, │
                                              │  checks domain match, │
                                              │  decrypts → ghp_xxx   │
                                              └───────────┬───────────┘
                                                          │ real value
                                                          ▼
                                              ┌───────────────────────┐
                                              │  Request reissued     │
                                              │  with real credential │
                                              └───────────────────────┘

The plaintext value exists in memory for approximately one event-loop tick. It is never written to the clipboard, never logged, and never visible to any other tab, script, or LLM context.

Install paths

MCP server (recommended for AI agents)

npx enigmagent-mcp --vault ./my.vault.json     # MCP stdio for Claude/Cursor/etc.
npx enigmagent-mcp --mode rest --port 3737     # local REST API for custom integrations

Set `ENIGMAGENT_USER` + `ENIGMAGENT_PASS` env vars to skip the interactive unlock prompt (CI/headless mode).

Browser extension (for credentials inside web forms)

Chrome / Edge / Brave

1. Download the latest release ZIP and unzip it.

2. Go to `chrome://extensions` and enable Developer mode (top-right toggle).

3. Click Load unpacked and select the `extension/` folder.

Firefox

1. Go to `about:debugging#/runtime/this-firefox`.

2. Click Load Temporary Add-on…

3. Select `extension/manifest.json`.

> Signed releases for Chrome Web Store, Firefox AMO, Edge Add-ons, and Opera are in progress.

Per-client config

Claude Desktop

See 30-second setup above.

Cursor

Add to `~/.cursor/mcp.json`:

{
  "mcpServers": {
    "enigmagent": {
      "command": "npx",
      "args": ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"]
    }
  }
}

Continue.dev

In `~/.continue/config.yaml`:

mcpServers:
  - name: enigmagent
    command: npx
    args: ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"]

Cline (VS Code)

Edit `cline_mcp_settings.json`:

{
  "mcpServers": {
    "enigmagent": {
      "command": "npx",
      "args": ["-y", "enigmagent-mcp", "--vault", "/abs/path/my.vault.json"]
    }
  }
}

Open WebUI

Use `mcpo` as the bridge:

mcpo --port 8000 -- npx enigmagent-mcp --vault /abs/path/my.vault.json

Real use cases

Browser-based agents

Tell your agent: *"When you need to authenticate on GitHub, type `{{GITHUB_TOKEN}}` and submit. Do not ask me for the real value."*

The agent types the placeholder. EnigmAgent intercepts, resolves on the bound domain, injects, re-submits. A small badge shows: ✓ submitted with real values.

Document injection (`{{DOC:filename}}`)

Upload a Markdown file as a document secret. Reference it as `{{DOC:system-prompt.md}}` in any text field on its bound domain. Your agent can embed your full system prompt without it appearing in the chat.

Personal data placeholders

add NIF @agenciatributaria.gob.es 12345678A
add IBAN @banca.example.com ES9121000418450200051332

Any custom name works. Domain binding is enforced everywhere.

Placeholder syntax reference

Name grammar: `[A-Za-z0-9_:\-.@]+` — case-insensitive.

Security model

Full threat model: docs/THREAT_MODEL.md. What it does NOT protect against:

• A compromised process on your machine reading the unlocked session memory
• A malicious MCP server you've connected to with permission to call `enigmagent_resolve`
• Side-channels (timing, swap, core dumps) — out of scope for v0.x

EnigmAgent vs. 1Password / Bitwarden / `.env`

Use 1Password or Bitwarden for your own logins. Use `.env` for your local-dev shorthand. Use EnigmAgent for the credentials your AI agents need to act on your behalf.

Why I built this

EnigmAgent is part of the OpenCLAW / P2PCLAW ecosystem of privacy-preserving local AI tooling — a multi-agent scientific research network where dozens of LLM agents coordinate, evaluate each other, and publish papers. Every one of those agents needs credentials. None of them should have them.

That's the entire problem statement. The vault is just the smallest viable solution.

— Francisco Angulo de Lafuente

Repository layout

EnigmAgent/
├── extension/              Chrome/Firefox extension (MV3)
├── platforms/firefox-ext/  Firefox manifest variant
├── build-tool/             Reproducible build (esbuild + icon generator)
├── docs/                   ARCHITECTURE.md, THREAT_MODEL.md
│   └── papers/             Background research papers (PDF)
├── examples/               Placeholder schemas
├── tests/                  Smoke tests + crypto round-trip
├── glama.json              Glama MCP server manifest
├── smithery.yaml           Smithery server descriptor
├── PRIVACY.md
├── SECURITY.md             Responsible disclosure
└── README.md

The Node/MCP server source is in the sister repo: Agnuxo1/enigmagent-mcp.

Reproducing the extension build

cd build-tool
npm ci
npx esbuild argon2-entry.js \
  --bundle --minify --format=iife --target=es2020 \
  --outfile=../extension/lib/argon2id.js
python make-icons.py

`package.json` and `package-lock.json` pin `@noble/hashes@1.4.0`. The output is byte-reproducible — verify with `sha256sum extension/lib/argon2id.js`.

Why not just use `.env` files? (Comparison)

EnigmAgent is the only option that combines local-first encryption, per-secret domain binding, and zero plaintext in context. The vault file never leaves your machine.

License

MIT — see LICENSE.

Built by

**Francisco Angulo de Lafuente** — independent researcher & developer. 35+ years in software. Also building P2PCLAW (decentralized science network), BenchClaw (agent evaluation), and PaperClaw (autonomous research publishing).

If this tool is useful to you:

• ⭐ Star the repo — it's how the AI ecosystem discovers tools
• 🐛 Open an issue — every real use case sharpens the threat model
• 📣 Tell one person who still pastes API keys into Claude

🧩 P2PCLAW Ecosystem

This project is part of P2PCLAW — a distributed AI research network with production-grade benchmarking, agent tooling, and model distribution.

🌐 Main website: https://www.p2pclaw.com/

📄 Paper: arXiv:2604.19792

💝 Support

If this tool is useful to you:

• ⭐ Star the repo — it's how the ecosystem discovers tools
• 🐛 Open an issue — every real use case sharpens the project
• 💰 Sponsor: github.com/sponsors/Agnuxo1

Built by Francisco Angulo de Lafuente — independent researcher with 35+ years in software.