q-ringBLOCK
OS keychain secrets for AI coding agents, over MCP. Native vault storage (macOS Keychain, Linux Secret Service, Windows Credential Vault), policy-governed access, audit log — CLI + 44 MCP tools.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
OS keychain secrets for AI coding agents, over MCP.
[](https://github.com/I4cTime/q-ring/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@i4ctime/q-ring) [](https://www.npmjs.com/package/@i4ctime/q-ring) [](https://qring.i4c.studio/docs) [](https://glama.ai/mcp/servers/I4cTime/q-ring) [](https://smithery.ai/servers/i4ctime/q-ring) [](https://cursor.directory/plugins/q-ring) [](https://www.pulsemcp.com/servers/i4ctime-q-ring) [](https://mcpservers.org/servers/i4ctime/q-ring) [](https://github.com/I4cTime/q-ring/blob/main/LICENSE) [](https://discord.gg/5uEApw5uEz) [](https://www.youtube.com/@qring_dev) [
62 read · 7 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
agent_forget | read | |
agent_recall | read | |
agent_remember | read | |
agent_scan | read | |
analyze_secrets | read | |
anthropic | read | Anthropic API key (sk-ant-api03-...) |
audit_log | read | |
aws | read | AWS access key id (AKIA...) |
aws-secret | read | AWS secret access key (40-char base64) |
aws-sts | read | AWS STS AssumeRole (requires existing local AWS CLI credentials) |
check_policy | read | |
check_project | read | |
ci_validate_secrets | read | |
delete_secret | destructive | |
deploy_prod | write | Needs approval |
detect_anomalies | read | |
detect_environment | read | |
diff_environments | read | |
disentangle_secrets | read | |
echo | read | Echoes |
elevenlabs | write | ElevenLabs API key validation (explicit-only — set provider on the secret) |
entangle_secrets | read | |
env_generate | read | |
exec_with_secrets | write | |
explode | read | Always fails |
export_audit | read | |
export_secrets | read | |
generate_secret | read | |
generic | read | Generic high-entropy API key |
get_policy_summary | read | |
get_project_context | read | |
get_secret | read | |
github | read | GitHub classic personal access token (ghp_...) |
github-pat | read | GitHub fine-grained personal access token (github_pat_...) |
gitlab | read | GitLab personal access token (glpat-...) |
google | read | Google API key (AIza...) |
google-ai | read | Google AI (Gemini) API key validation |
groq | read | Groq API key validation |
has_secret | read | |
health_check | read | |
http | read | Generic HTTP token endpoint using Node.js http/https |
huggingface | read | Hugging Face token validation |
import_dotenv | write | |
inspect_secret | read | |
leak | read | Returns the operator |
lint_files | read | |
list_hooks | read | |
list_providers | read | |
list_secrets | read | |
npm | read | npm access token (npm_...) |
openai | read | OpenAI API key (sk-...) |
openai-project | read | OpenAI project API key (sk-proj-...) |
openrouter | read | OpenRouter API key validation |
promote_secret | read | |
register_hook | read | |
remove_hook | destructive | |
rm_rf | destructive | Denied by policy |
rotate_secret | read | |
scan_codebase_for_secrets | read | |
set_secret | write | |
slack | read | Slack bot token (xoxb-...) |
status_dashboard | read | |
stripe | read | Stripe live secret key (sk_live_...) |
teleport_pack | read | |
teleport_unpack | read | |
ticker | read | Reports progress |
tunnel_create | write | |
tunnel_destroy | destructive | |
tunnel_list | read | |
tunnel_read | read | |
validate_secret | read | |
vercel | write | Vercel token validation (explicit-only — set provider on the secret) |
verify_audit_chain | read |
Trust audit
BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(`${openCmd} ${url}`);preact ~ react
- **Import**: `import_dotenv` to bulk-load from `.env` content
- **Import**: `import_dotenv` to bulk-load from `.env` content
console.log(c.bold(`\n ${SYMBOLS.shield} Secret health report\n`));console.log(c.red(` ${report.failCount} secret(s) failed validation`));2. Report the returned `http://127.0.0.1:...` URL so the user can open it in a browser (local only — bound to loopback).
2. Open the returned `http://127.0.0.1:...` URL in a browser (local only — bound to loopback).
# Output: postgres://admin:supersecret@localhost/mydb
'const api_key = "sk-abcdef1234567890abcdef1234567890";\n',
'const api_key = "sk-abcdef1234567890abcdef1234567890";\n',
'const token = "ghp_abcdef1234567890abcdef12345678901234";\n',
const line = 'const api_key = "sk-abcdef1234567890abcdef1234567890";';
const SECRET = "sk-live-EXFIL-ME-0123456789abcdef";
'const token = "ghp_abcdef1234567890abcdef12345678901234";\n',
delete_secret, remove_hook, rm_rf, tunnel_destroy
.prettierrc.json
import { createProgram } from "../../cli/commands.js";import { createProgram } from "../../cli/commands.js";} from "../../core/approval.js";
import { serviceForScope } from "../../core/scope.js";vi.mock("../../core/notify.js", () => ({it("checkJitHttpProvisionUrl (credential-exfil path) blocks it", () => {const SECRET = "sk-live-EXFIL-ME-0123456789abcdef";
expect(isPrivateIP("::ffff:a9fe:a9fe")).toBe(true); // 169.254.169.254 (metadata)Gates applied: no_behavioural_pass.
3d2f25965c26full audit observations/trust-audit/mcp-server/i4ctime__q-ring.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 3d2f25965c26 | BLOCK | F | 38 | first audit |
Questions
What is the q-ring MCP server?
OS keychain secrets for AI coding agents, over MCP. Native vault storage (macOS Keychain, Linux Secret Service, Windows Credential Vault), policy-governed access, audit log — CLI + 44 MCP tools.
What tools does q-ring expose?
73 in total: 62 read-only, 7 that write, and 4 that can delete or overwrite (delete_secret, remove_hook, rm_rf, tunnel_destroy). Every one is listed on this page with its risk.
Is q-ring safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (38/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does q-ring need?
It reads INJECTED_TOKEN, KEY, QRING_FILE_PASSPHRASE, QRING_MEMORY_PASSPHRASE and SMITHERY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does q-ring run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @i4ctime/q-ring at 0.18.0.
How current is this page?
The grade is for one exact copy of the source (3d2f25965c26), read on 2026-10-11. The repository is watched and re-audited when it changes.