API Locker

Encrypted credential vault with a 21-tool MCP server. Store and manage LLM API keys, service API keys, and OAuth credentials — then let your AI agent list, reveal, rotate, rename, pause, and proxy calls through them.

该来源不提供完整文件导出（国内平台多为平台内托管），仅存元数据与原链

接入信息

传输形态: http
鉴权方式: 鉴权未知
端点: https://apilocker--asancivieri.run.tools

鉴权方式未标注，请核对官方文档后再接入——不要直接使用以下片段

{
  "mcpServers": {
    "API Locker": {
      "url": "https://apilocker--asancivieri.run.tools"
    }
  }
}

能力清单

工具	说明
list_keys	List credentials in the user's vault grouped by category (LLM / Service / OAuth). Returns metadata only — never raw secret values. Optionally filter by category, provider, or tag.
get_key_metadata	Get full metadata for one credential by its alias (name). Returns provider, type, tags, paused state, rotation history. Does not reveal the secret value.
reveal_key	Reveal the decrypted value of a credential by alias. For api_key credentials, returns the single secret string. For oauth2 credentials, returns the full multi-field object (client_id, client_secret, refresh_token, etc.). The agent should treat the response as sensitive — log it, store it, or pass it carefully.
list_providers	List all available provider templates. Useful for discovering what providers can be used when storing new credentials.
get_activity	Get recent audit log entries showing how credentials have been used. Returns proxy calls, reveals, rotations, renames, pauses, etc. Each entry includes timestamp, status code, latency, and the credential involved.
run_doctor	Run a security health check on the vault. Returns warnings about stale rotations, unused keys, expiring tokens, stale devices. The same checks the CLI `apilocker doctor` command runs.
proxy_request	Make an API request through the locker proxy. The real API key is injected automatically — the agent never sees the raw secret. Use this when you need to call an external API (OpenAI, Stripe, etc.) using a stored credential.
store_key	Store a new api_key credential in the vault. The secret is encrypted with AES-GCM before being stored. Use store_oauth_credential for multi-field OAuth credentials. Requires master token auth.
store_oauth_credential	Store a new OAuth multi-field credential (client_id, client_secret, refresh_token, etc.). For OAuth providers like Google, GitHub, Slack, Microsoft, Notion, Spotify, Twitter, LinkedIn, Discord, Zoom, Dropbox, Salesforce, HubSpot. Requires master token auth.
rotate_key	Replace a credential's value in place with a new one. The credential's name, provider, and all metadata stay the same. Scoped tokens that reference the key continue to work. Requires master token auth.
rename_key	Rename a credential alias. The old name is remembered as a legacy alias forever, so existing references to the old name continue to work transparently. Requires master token auth.
pause_key	Pause proxy access for a credential without deleting it. Reveal/run/get/env operations still work on paused credentials. The proxy returns HTTP 423 for paused keys until they are resumed. Requires master token auth.
resume_key	Resume proxy access for a paused credential. Requires master token auth.
delete_key	Permanently delete a credential. The encrypted blob is removed from KV and the metadata row is removed from D1. This cannot be undone. Requires master token auth.
list_tokens	List scoped access tokens for the user's account. Each token authorizes proxy/MCP access to a specific subset of credentials. Requires master token auth.
create_token	Create a new scoped access token. Returns the access token and (for rotating tokens) the refresh token. Requires master token auth.
pause_token	Pause a scoped token. Paused tokens cannot be used until resumed. Requires master token auth.
resume_token	Resume a paused scoped token. Requires master token auth.
revoke_token	Permanently revoke (delete) a scoped token. Cannot be undone. Requires master token auth.
list_devices	List all devices registered to the user's account. Requires master token auth.
revoke_device	Revoke a registered device. The device's master token immediately stops working. Requires master token auth.

纠错与举报（发现条目失效、署名有误或涉及侵权？）

提交举报 / 纠错

侵权举报经核验成立后，我们会即时下线该条目并删除已存的内容副本。