keyway-mcp

The server demonstrates excellent security practices. It uses strong encryption (AES-256-GCM) for stored authentication tokens, enforces strict file permissions (0600) for the encryption key, and validates HTTPS for API communication. Crucially, sensitive values are never exposed to the AI or logs; tools like `keyway_generate`, `keyway_scan`, and `keyway_diff` return masked previews, and `keyway_inject_run` meticulously redacts secrets from command output while preventing shell injection via `shell: false`. Input validation (using Zod) is robust across all tools. The explicit documentation regarding `keyway_set_secret` being the only tool where the AI supplies the raw value is a strong point of transparency. The only reason it's not a 10 is the inherent complexity of perfect output masking and false positive detection, though the implementation appears highly robust.