@safekb/mcp 0.10.1 → 0.11.0

package/README.md

@@ -371,6 +371,11 @@ custom fields and the key name of every custom field (sealed ones too) stay read
   space takes its credentials along (a credential's group in the old space is left behind).
 - `reveal_sealed_credential` and `get_sealed_totp` decrypt locally. The hosted `reveal_credential` and
   `get_credential_totp` cannot open a sealed credential.
+- AI access (`llm_visibility`): `visible`, `use_only` or `human_only`. `reveal_sealed_credential` and
+  `get_sealed_totp` work only on `visible` credentials. New and migrated sealed credentials start
+  `use_only`; only you make one `visible`, in the SafeKB app. `set_sealed_credential_llm_visibility`
+  only tightens it. The client enforces this: a client older than 0.11.0 still reveals every sealed
+  credential.
 - Visible fields can be edited without the secret. Such an edit is flagged (`visible_tampered`) with the
   changed fields until a signed save accepts it (`accept_visible_changes`).
 

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.10.1",
+  version: "0.11.0",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -3276,6 +3276,11 @@ class SealedApi {
   fetchSealedCredential(id) {
     return this.http.getJson(`/credentials/${id}/sealed`);
   }
+  setLlmVisibility(id, llmVisibility) {
+    return this.http.putJson(`/credentials/${id}/sealed/llm-visibility`, {
+      llm_visibility: llmVisibility
+    });
+  }
   lastAttestedVisibleFields(id) {
     return this.http.getJson(`/credentials/${id}/sealed/attested`);
   }
@@ -9289,7 +9294,17 @@ class CredentialAccess {
     return serializeEnvelope(await wrapDek(keys, credentialId, dek));
   }
   async open(credentialId) {
+    return this.decrypt(await this.ctx.api.fetchSealedCredential(credentialId));
+  }
+  async openForReveal(credentialId) {
     const credential2 = await this.ctx.api.fetchSealedCredential(credentialId);
+    if (credential2.llm_visibility !== "visible") {
+      throw new ClientError(`Credential ${credentialId} (${credential2.title}) is ${credential2.llm_visibility}: its secrets are never shown to an LLM. No tool uses a secret without showing it yet: ask the user to enter it. Only the user can change this, in the SafeKB app.`);
+    }
+    return this.decrypt(credential2);
+  }
+  async decrypt(credential2) {
+    const credentialId = credential2.id;
     const { keys } = await this.ctx.session.open(credential2.seal_root_id);
     const dek = await unwrapDek(keys, credentialId, parseEnvelope(credential2.enc_dek));
     const values = await unsealCredentialFields(dek, this.context(credentialId), credential2.enc_fields);
@@ -9736,7 +9751,7 @@ class CredentialService {
     this.access = access;
   }
   async reveal(credentialId, field) {
-    const open5 = await this.access.open(credentialId);
+    const open5 = await this.access.openForReveal(credentialId);
     const value = this.valueOf(open5, field);
     return {
       id: credentialId,
@@ -9747,7 +9762,7 @@ class CredentialService {
     };
   }
   async totp(credentialId, nowMs = Date.now()) {
-    const open5 = await this.access.open(credentialId);
+    const open5 = await this.access.openForReveal(credentialId);
     const code = await totp(parseTotp(this.valueOf(open5, "totp")), nowMs);
     return {
       id: credentialId,
@@ -9756,6 +9771,10 @@ class CredentialService {
       ...await this.attestation(open5.credential)
     };
   }
+  async setLlmVisibility(credentialId, llmVisibility) {
+    const credential2 = await this.ctx.api.setLlmVisibility(credentialId, llmVisibility);
+    return { id: credential2.id, llm_visibility: credential2.llm_visibility };
+  }
   valueOf(open5, field) {
     const { values, credential: credential2 } = open5;
     const value = field.startsWith(CUSTOM_PREFIX2) ? values.custom.find((item) => item.key === field.slice(CUSTOM_PREFIX2.length))?.value : SEALED_CREDENTIAL_FIELDS.includes(field) ? values[field] : undefined;
@@ -35750,12 +35769,16 @@ var sealedFields = {
 };
 function credentialTools(credentials, migration, names) {
   return [
-    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). ${EXPOSURE_NOTE}`, {
+    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, {
       credential_id: credentialId,
       field: exports_external.string().min(1).describe("password, totp, sealed_notes, or custom:{key}.")
     }, (args) => credentials.reveal(args.credential_id, args.field)),
-    defineTool("get_sealed_totp", `Compute the current TOTP code of a sealed credential on this machine, without revealing the seed. ${EXPOSURE_NOTE}`, { credential_id: credentialId }, (args) => credentials.totp(args.credential_id)),
-    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
+    defineTool("get_sealed_totp", `Compute the current TOTP code of a sealed credential on this machine, without revealing the seed. Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, { credential_id: credentialId }, (args) => credentials.totp(args.credential_id)),
+    defineTool("set_sealed_credential_llm_visibility", "Make a sealed credential's secrets less visible to LLMs: use_only (never revealed to an LLM) or human_only (never revealed, entered by a person). It only tightens: human_only cannot go back to use_only from here, and only the user makes a credential visible, in the SafeKB app. The value is not signed and does not change the credential's version.", {
+      credential_id: credentialId,
+      llm_visibility: exports_external.enum(["use_only", "human_only"]).describe("human_only is the more restrictive.")
+    }, (args) => credentials.setLlmVisibility(args.credential_id, args.llm_visibility)),
+    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. It starts use_only: its secrets cannot be revealed to an LLM until the user makes it visible in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
       root_id: rootRef("The seal root that will own it."),
       title: exports_external.string().min(1).describe("Visible to the server."),
       folder_id: exports_external.string().min(1).describe("Group it belongs to.").optional(),
@@ -35946,6 +35969,7 @@ The keys of this machine, and backups, are handled by tools that never take or r
 A credential with \`sealed: true\` belongs to a seal root. Its title, username, url, tags, notes and visible custom fields are readable by the server: find it with the standard credential tools. Its password, TOTP seed, sealed_notes and sealed custom fields open only here: reveal_sealed_credential, get_sealed_totp, insert_sealed_credential, update_sealed_credential.
 
 - Reveal a secret only when the task needs it, and prefer get_sealed_totp over revealing a TOTP seed.
+- llm_visibility: reveal_sealed_credential and get_sealed_totp work only on visible credentials; on use_only and human_only ones, ask the user to enter the secret. New sealed credentials start use_only, and only the user makes one visible, in the SafeKB app.
 - visible_tampered means the visible fields were changed without the key since the last sealed save. Do not trust the url or username of such a credential until the user has reviewed the change.`;
 function createSealedTools(ctx) {
   const services = createSealedServices(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",