What is SkillFM BYOK Vault?

BYOK vault, provider API key guidance, usage visibility, and SkillFM Beacon checks for MCP agents.

How do I install SkillFM BYOK Vault?

Install SkillFM BYOK Vault via npm from https://registry.npmjs.org, then add the server config to your MCP client (Claude Desktop, Cursor, or VS Code).

Is SkillFM BYOK Vault open source?

Yes, SkillFM BYOK Vault is open source under the MIT license. Source code is available at https://github.com/ericm1018/skillfm-byok-vault-mcp.

What category does SkillFM BYOK Vault belong to?

SkillFM BYOK Vault is listed under Security & Auth MCP servers on MCPFind.

SkillFM BYOK Vault — MCP Server for Security & Auth

SkillFM BYOK Vault MCP

BYOK vault and provider API key usage guidance for MCP-capable agents.

This repository is a transparent SkillFM gateway package. It exists to match a specific marketplace/search intent, then delegates execution to the canonical SkillFM Beacon MCP and local runtime.

Quick Start

Use this gateway as an MCP stdio server:

npx -y @skillfm/byok-vault-mcp@latest

Equivalent explicit SkillFM entrypoint:

npx -y @skillfm/mcp@latest

For MCP clients that accept JSON config:

{
  "mcpServers": {
    "byok-vault": {
      "command": "npx",
      "args": ["-y", "@skillfm/byok-vault-mcp@latest"]
    }
  }
}

What This Gateway Helps With

Explain provider-key safety before asking users to connect any key.
Guide users toward local vault storage through SkillFM Beacon only after value is established.
Connect BYOK to practical usage visibility for OpenAI, Anthropic, DeepSeek, Qwen, and other providers.
Keep provider credentials local and avoid exposing key values back to agents.

This gateway is for users who ask:

"How do I safely connect an OpenAI or Anthropic key?"
"Can my agent monitor usage with my own provider keys?"
"Where should BYOK credentials live?"
"Can I get value before giving any API key?"

How It Works

The public package is intentionally thin. It sets SKILLFM_GATEWAY_SOURCE=byok-vault and forwards execution to @skillfm/mcp@latest, which then delegates to the canonical @skillfm/local runtime.

No private SkillFM platform logic, customer data, provider credentials, or backend modules live in this repository.

Activation Path

Start the local sidecar when the user wants to connect SkillFM:

npx -y @skillfm/byok-vault-mcp@latest start

Agent-driven activation flow:

Read the sidecar URL from stdout or ~/.skillfm/local.json.
Call POST <sidecar_url>/activate/start.
Show the returned verification URL and real device code to the user.
Poll POST <sidecar_url>/activate/poll until it returns activated: true.
Use SkillFM Beacon MCP tools for checkups, usage visibility, BYOK guidance, and cleanup audits.

Do not fabricate a placeholder code. The device code must come from POST /activate/start.

Security Model

Transparent gateway: This package is a public search/distribution gateway, not a separate hidden product.
Local-first runtime: Runtime execution goes through SkillFM's local package.
BYOK boundary: Provider keys are introduced only after user value is established, and key values are not read back by agents.
No private core: This repository contains distribution metadata, docs, and a thin launcher only.
Read-only first: Cleanup and usage inspection begin with read-only audits.

See PRIVACY.md and SECURITY.md.

Marketplace Keywords

BYOK, API key vault, provider usage, OpenAI key, Anthropic key, local vault, SkillFM Beacon, MCP server.

Expected Official MCP Registry single-token hits:

byok
vault
api-key
provider
usage
skillfm

License

MIT

Set up in your AI client

AI clientOperating system

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json

{
  "mcpServers": {
    "io-github-ericm1018-skillfm-byok-vault-api-key-provider-usage": {
      "command": "npx",
      "args": [
        "-y",
        "@skillfm/byok-vault-mcp"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Compatible MCP Clients

SkillFM BYOK Vault works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.

Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.

VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.

Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.

Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

SkillFM BYOK Vault