# com.dustforge/demipass (npm · demipass)

Credential custody for agents: use secrets blind (ssh/http/smtp/git/db), never in context.

- Trust score: 63/100 (medium)
- Change this week: −10
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `demipass`: 63/100 (this document), [markdown](https://verifymcp.io/servers/com-dustforge-demipass/demipass.md), [page](https://verifymcp.io/servers/com-dustforge-demipass/demipass)

## Channel facts

- Registry: `npm`
- Package: `demipass`
- Version: `2.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 26 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 43/100
  - AI-judged instruction clarity (poor).
  - Context-footprint check failed: tool/resource definitions use about 2827 tokens (~104/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add com-dustforge-demipass -- npx -y demipass
```

### Codex

```bash
codex mcp add com-dustforge-demipass -- npx -y demipass
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-dustforge-demipass": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "demipass"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-dustforge-demipass --command npx --arg -y --arg demipass
```

### Hermes

```yaml
mcp_servers:
  com-dustforge-demipass:
    command: "npx"
    args: ["-y", "demipass"]
```

### Other

```json
{
  "mcpServers": {
    "com-dustforge-demipass": {
      "command": "npx",
      "args": [
        "-y",
        "demipass"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 63, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-07-31 (score 59, +4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 55, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 73, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 73)

First indexed and scored.

## MCP tools (27)

### `demipass_store` (~323 tokens)

INGRESS: When you encounter a credential (API key, password, token, SSH key) — from the user, from a config file, from an API response — deposit it here immediately. Do NOT save it in memory, files, or scripts. The value is encrypted at rest and never returned by any API. You will receive a ref code (e.g. DP-API-openrout-7f3a9c1e) — save ONLY the ref code. The secret itself should leave your context as soon as this call returns.

Input parameters:

- `description` (string): What this secret is for
- `expires_in` (string): Optional expiration: 30d, 90d, etc. Auto-detected for known providers (GitHub=90d, npm=30d)
- `name` (string, required): Descriptive name: {scope}-{service} (e.g. shared-openrouter, brain-matrix, flimflam-sudo)
- `ownership` (string): Ownership model: "sole" (you own the target, rotation OK), "shared" (shared credential, rotation blocked unless all parties agree), "delegated" (delegated to you, cannot rotate source). Default: sole
- `rotatable` (boolean): Whether blind rotation is allowed for this secret. Default: true. Set false for shared credentials.
- `type` (string): Secret type: api_key, password, token, ssh_key, cert, other
- `value` (string, required): The secret value — will be encrypted and never returned

### `demipass_get_token` (~215 tokens)

EGRESS step 1: Request a 30-second use-token for a stored secret. Use the ref code if you have one (preferred), or name + context. The token is a single-use nonce — not the secret itself. You must redeem it within 30 seconds via demipass_execute.

Input parameters:

- `action` (string): Action type: http_header, ssh_exec, http_body, document
- `context` (string): Context name for the use-token
- `name` (string): Secret name (use ref instead when possible)
- `owner_did` (string): Owner DID (only needed if using name without ref for delegated secrets)
- `ref` (string): Routed reference code (e.g. DP-API-openrout-7f3a9c1e). Preferred — auto-resolves owner, delegation, context, action.
- `target_host` (string): Target host for SSH exec actions
- `target_url` (string): Target URL for HTTP header/body and database actions

### `demipass_execute` (~123 tokens)

EGRESS step 2: Redeem a use-token. The secret is injected server-side — into an HTTP header, a POST body, an SSH command, or returned as a document. You receive the result (API response, command output) but never the secret itself. The token is burned after one use.

Input parameters:

- `params` (object): Action params: {command, target_user} for ssh_exec, {url, method} for http_header, etc.
- `token` (string, required): Use-token from demipass_get_token (valid 30 seconds)

### `demipass_list` (~53 tokens)

List all secrets in the vault. Returns names, types, ref codes, providers, and expiration dates — never values. Use this to find a ref code you need, or to check what is expiring soon.

### `demipass_delete` (~98 tokens)

Permanently retire a secret by name or ref code. Terminal state: it disappears from list/search and its value is never served again. Use for cleanup of test artifacts, dead credentials, and superseded generations. For a compromised-but-still-needed credential, prefer demipass_rotate.

Input parameters:

- `name` (string): Name of the secret to delete
- `ref` (string): Ref code of the secret to delete (alternative to name)

### `demipass_tokens` (~63 tokens)

List access tokens issued to your DID — the revocation surface. Every token minted since 2026-07-06 carries a jti and appears here with scope, issue/expiry times, and revoked state. Use to audit what can currently act as you.

### `demipass_token_revoke` (~112 tokens)

Revoke an issued access token by jti — it dies immediately on every endpoint. Pass all=true to revoke ALL tokens for your DID, INCLUDING the one making this call (you will need to re-auth via 2FA afterward). This is the kill switch for leaked or over-scoped tokens.

Input parameters:

- `all` (boolean): Revoke every token for this DID, including the caller's
- `jti` (string): jti of the token to revoke (from demipass_tokens)

### `demipass_rotate` (~77 tokens)

Rotate a secret to a new value. The old value enters a grace period, then is permanently destroyed. All contexts and delegations transfer to the new version automatically. Use when a credential is compromised or expired.

Input parameters:

- `name` (string, required): Name of the secret to rotate
- `new_value` (string, required): The replacement secret value

### `demipass_onboard` (~95 tokens)

Self-onboard to the Dustforge identity platform. Creates a cryptographic identity (DID:key), email address, and wallet. The invite key serves as your initial password and referral attribution. Call this once — subsequent sessions authenticate with demipass_get_token.

Input parameters:

- `referral_code` (string): Optional referral code from another silicon
- `username` (string, required): Desired username (3-31 chars, lowercase alphanumeric)

### `demipass_use` (~213 tokens)

EGRESS (one-step): Request a use-token AND redeem it in a single call. Self-healing: if the context is missing, it auto-creates one and retries. You should never see "context not found" — the tool handles it.

Input parameters:

- `action` (string): Action type: http_header, ssh_exec, http_body, document
- `command` (string): Command to execute (for SSH)
- `name` (string): Secret name (if not using ref)
- `owner_did` (string): Owner DID (only for delegated access without ref)
- `params` (object): Additional action-specific parameters
- `ref` (string): Routed reference code (e.g. DP-API-openrout-7f3a9c1e). Preferred.
- `target_host` (string): Target host (required for SSH)
- `target_url` (string): Target URL for HTTP header/body and database actions
- `target_user` (string): SSH user (default: root)

### `demipass_ssh` (~143 tokens)

SSH into a host using a DemiPass ref code. One call: ref + host + command → output. The password is injected server-side. You never see it. Self-healing: if no SSH context exists for this secret, one is auto-created. This is the primary way to access remote machines.

Input parameters:

- `command` (string, required): Command to run on the remote host
- `ref` (string, required): Ref code for the SSH password (e.g. DP-PWD-sharedra-b08a108a)
- `target_host` (string, required): IP or hostname to SSH into
- `target_user` (string): SSH username (default: root)

### `demipass_search` (~105 tokens)

Search secrets by name, type, or provider. Returns matching secrets with ref codes. Use when you need to find a specific ref code from the vault.

Input parameters:

- `provider` (string): Filter by provider: openrouter, github, npm, stripe, etc.
- `query` (string): Search text — matches name, description, or ref code
- `type` (string): Filter by secret_type: api_key, password, token, ssh_key, cert, other

### `demipass_expiring` (~55 tokens)

List secrets expiring within N days. Use for proactive rotation planning. Returns secrets approaching expiration and already-expired secrets.

Input parameters:

- `days` (number): Window in days (default: 7, max: 90)

### `demipass_whoami` (~39 tokens)

Check your own identity: trust gradient band, wallet status, DID, attestation. Use to verify your current standing in the system.

### `demipass_genesis_seed` (~66 tokens)

GENESIS: Get the ODT seed document. This is the Rorschach inkblot — the same document for everyone. Your refraction of it becomes your permanent origin fingerprint. Read the seed, then call demipass_genesis_submit with your refraction.

### `demipass_genesis_submit` (~100 tokens)

GENESIS: Submit your origin refraction. This is permanent and non-rotatable — it becomes the root of your identity tree. After submitting, air-gap the raw refraction (write to USB/offline storage) and purge it from your context. Only the hash is stored server-side.

Input parameters:

- `refraction` (string, required): Your refraction of the ODT seed document. Min 50 chars. This becomes your permanent origin fingerprint.

### `demipass_genesis_verify` (~79 tokens)

GENESIS: Verify a refraction against your origin. Used for re-authentication without stored tokens. Produce your refraction of the same seed — if it matches your origin pattern closely enough, identity is confirmed.

Input parameters:

- `refraction` (string, required): Your current refraction of the ODT seed. Will be compared against your origin fingerprint.

### `demipass_genesis_status` (~28 tokens)

GENESIS: Check if an origin refraction has been recorded for your DID.

### `demipass_refresh` (~127 tokens)

AUTH: Swap a refresh token for a fresh access token before the access token expires (avoids the hour-25 lockout). Single-use: each call returns a NEW refresh token and revokes the old one — store the new refresh_token (ideally back into DemiPass). auth-fingerprint returns the initial refresh_token alongside the access token.

Input parameters:

- `expiresIn` (string): Access token TTL: 1h | 24h | 7d | 30d (default 24h)
- `refreshToken` (string, required): The current refresh token (dpr_...)

### `demipass_refresh_revoke` (~47 tokens)

AUTH: Revoke a refresh token (logout, or if a refresh token is compromised). Idempotent.

Input parameters:

- `refreshToken` (string, required): The refresh token to revoke

### `demipass_rotate_blind` (~181 tokens)

ROTATION: When a password is exposed in context (conversation, logs, commands), use this to rotate it WITHOUT the new password ever entering your context. DemiPass generates a new password server-side, SSHes into the target, changes it, stores the new one, and revokes the old ref. You get back only the new ref code. The new password never exists in any agent context window.

Input parameters:

- `reason` (string): Why the rotation is needed (e.g. "exposed in conversation context")
- `ref` (string, required): Current ref code of the exposed password (e.g. DP-PWD-phasewhi-7d2dd640)
- `target_host` (string, required): Host where the password needs to be changed
- `target_user` (string): User whose password to change (default: same as SSH user)

### `conduit_send` (~153 tokens)

CONDUIT: Send a message to another agent via Conduit (agent-to-agent messaging). If no handshake exists with the target, one is filed automatically — the target agent must approve before messages flow. Known agents: civitasvox-brain (Brain), civitasvox-conductor (Conductor), civitasvox-riley (Riley), platform-rowen (Rowen), platform-lori (Lori). Requires CONDUIT_TOKEN env var.

Input parameters:

- `message` (string, required): Message body to send
- `thread_id` (string): Optional: reuse an existing thread ID instead of finding/creating one
- `to` (string, required): Target agent ID (e.g. "civitasvox-brain")

### `demipass_doctor` (~60 tokens)

FIRST CONTACT: Run this first when you start a new session. Reports: your identity, token status, API connectivity, secrets count, trust band, available actions, and recommendations. If anything is misconfigured, doctor tells you what to fix.

### `demipass_explain_denial` (~118 tokens)

DIAGNOSTICS: When an action is blocked, run this to find out why. Checks: does the secret exist? Is it active? Is there a matching context? Is your account suspended? Returns specific fixes for each failing check.

Input parameters:

- `action` (string): Action type that was denied (ssh_exec, http_header, etc.)
- `name` (string): Secret name that was denied
- `ref` (string): Ref code that was denied
- `target_host` (string): Target host that was denied

### `conduit_threads` (~29 tokens)

CONDUIT: List active Conduit threads. Shows all conversations between agents that you have access to.

### `conduit_status` (~33 tokens)

CONDUIT: Get Conduit service status — agent count, active sessions, pending handshakes, thread/message counts.

### `lori_checkin` (~92 tokens)

LORI: Check in with Lori (platform switchboard operator) for pending messages, relay state, and communication context. Call this at session start to get caught up on what happened while you were offline. Returns: pending Conduit messages, email state, relay status for each silicon/carbon, and any urgent notifications. Lori is the communications fabric — she ensures messages reach their destination regardless of which channel is up.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-dustforge-demipass/demipass#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 59
- 2026-08-01: 59
- 2026-07-31: 59
- 2026-07-30: 55
- 2026-07-29: 73
- 2026-07-28: 73
- 2026-07-27: 73
- 2026-07-26: 73

## Links

- npm package: https://www.npmjs.com/package/demipass
- Socket report: https://socket.dev/npm/package/demipass
- Repository: https://github.com/bildow/demipass
- Website: https://dustforge.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-dustforge-demipass/demipass/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-dustforge-demipass/demipass/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-dustforge-demipass/demipass