hush

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/omarei-omoto-hush

About

Use cases: identity-access, ci-cd

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools

6 read · 5 write · 0 delete

Secrets

None asked for

Install scripts

None found

Runs as

Node.js package

Tools (11)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• hush_add_secret

  Add a credential to the vault WITHOUT it passing through this conversation. A secure input box opens on the user's screen; they paste the value there and it is encrypted straight into the vault. You get back only a confirmation. ALWAYS use this instead of asking the user to paste a key into the chat. Give a set name (created if it doesn't already exist) and either a known service (hush knows which variables it needs, e.g. 'fal') or a bare key.

• hush_check_repo

  Scan the current codebase for the environment variables it references, and report which are present in the vault and which are missing. Use this before running or building a project to find out whether its configuration is complete.

• hush_describe_secret

  Describe one secret without revealing it: whether it exists, its length, a masked preview, who last set it and when. Use this to confirm a credential is configured.

• hush_list_accounts

  Deprecated (removed in hush 2.0), use hush_list_sets — this returns exactly the same thing. Kept registered so a skill file written before sets replaced accounts still works.

• hush_list_secrets

  List the NAMES of secrets available in one named set of the current project's vault. Returns names, which set they live in, and when they were last changed. Never returns secret values — use hush_run to actually use a secret.

• hush_list_sets

  The sets this hush broker offers and the variable names in each — names only, never values. Pass set names to hush_request as sets: ["<name>"]; a request that names none uses all of them.

• hush_provision

  Prepare a CLI or codebase to run with the right credentials. Give it a tool name (e.g. 'wrangler') and optionally which set to use. It works out which service the tool authenticates with, checks which of this project's used sets already provide it, prompts the user to add it if missing, and tells you the exact hush_run call to make. Use this when the user says something like 'set up wrangler with my personal Cloudflare set'.

• hush_push

  Send one of the project's secrets to where the app runs — Cloudflare Workers or Pages, Vercel, Convex, Fly.io, Railway, Firebase Functions, GitHub Actions, GitLab CI, Google Cloud Secret Manager, Koyeb, Fastly, Pulumi or SST — through that host's own CLI, with the value on its standard input. The value never passes through you or a command line, and hush refuses a value the host's CLI would change. The user approves each push. Use this instead of telling the user to paste a key into a dashboard, and instead of `sh -c '... | wrangler secret put'`.

• hush_request

  Make an authenticated HTTP request without the credential ever entering this conversation. Write $NAME where a secret belongs and hush substitutes it from the vault inside its own process; you get back the response with any secret values masked as [redacted:NAME]. Use this for any API call that needs a key, instead of trying to run curl/wget (denied) or building an Authorization header yourself. Secrets go into HEADER VALUES only unless you also list 'body' or 'query' in substitute. https only; the host must be one the policy allows.

• hush_run

  Run a shell command with the project's secrets injected as environment variables. The command sees real credentials; you only see its output, with any secret values masked. This is the correct way to perform a task that needs a credential (migrations, deploys, authenticated API calls) without the credential entering this conversation.

• hush_setup_status

  What is set up for hush on this machine and in this project, and what is next. Each step has a status, the exact command that does it, and a kind: auto (run it), choice (ask the user which option, then run it), or person (run it and wait: it asks the user on their screen, and you must never answer it or add --yes). Call this when the user asks you to set up hush, or when another hush tool says hush is not set up here. It never shows a secret.

Signals

Stars

6

Forks

2

Open issues

12

Weekly downloads

229

Last commit

Oct 18, 2026 (13 days ago)

Last release

Oct 18, 2026 (13 days ago)

Last package publish

Oct 18, 2026 (13 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.omarei-omoto/hush

Version

0.13.2

Auth

No auth

Packages

npm @omarei/hush

License

MIT

Repository

github.com/omarei-omoto/hush

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql