# Secure Local Memory MCP Server (`constant_quadruped/secure-local-memory-mcp`) Actor Model Context Protocol (MCP) server for encrypted local storage and memory vaults. - **URL**: https://apify.com/constant\_quadruped/secure-local-memory-mcp.md - **Developed by:** [CQ](https://apify.com/constant_quadruped) (community) - **Categories:** MCP servers, AI, Developer tools - **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Secure Local Memory MCP Server A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that stores key/value secrets **encrypted at rest** and lets an AI agent (or a batch job) store and retrieve them by key. Encryption is real AES-256-GCM with a key derived from your passphrase via scrypt — the ciphertext on disk never contains the plaintext, and the wrong passphrase fails authentication. It runs two ways: 1. **Platform / batch mode (default on Apify):** you pass a list of `commands` (or a single `query`) in the actor input. Each command is executed, the encrypted vault is persisted, and one result row per command is pushed to the dataset. 2. **Stdio MCP mode:** when no commands are supplied and a process pipes JSON-RPC into stdin, the actor speaks MCP (JSON-RPC 2.0) over stdin/stdout so it can be wired into an MCP client as a local server. --- ### What it does - Encrypts each stored value with **AES-256-GCM** (16-byte random salt + 12-byte random IV per value; key derived with `scrypt`). The stored blob is `base64(salt | iv | tag | ciphertext)`. - Persists the encrypted vault in a **named Apify key-value store** (`secure-local-memory-vault`), which is **not** purged between runs, so the vault **persists across runs**. - Decrypts on retrieval only with the correct passphrase. A wrong passphrase is rejected by the GCM authentication tag (you get an error, never a wrong/garbage value). #### MCP tools exposed | Tool | Arguments | Description | |------|-----------|-------------| | `store_secret` | `key` (string), `value` (string) | Encrypts and stores the value under `key`. | | `retrieve_secret` | `key` (string) | Decrypts and returns the value for `key`. | | `list_keys` | _(none)_ | Lists the keys in the vault. Values stay encrypted. | --- ### Input All fields are optional, but you must provide either `commands` or `query` for the actor to do anything in batch mode, and a `passphrase` (or the `SLM_PASSPHRASE` env var) is required before any secret can be encrypted/decrypted. | Field | Type | Required | Description | |-------|------|----------|-------------| | `passphrase` | string (secret) | Required to run commands | Master passphrase used to derive the AES key via scrypt. The **same** passphrase is needed to decrypt previously stored secrets. Falls back to the `SLM_PASSPHRASE` environment variable if omitted. | | `commands` | array of objects | No | Batch of tool calls. Each item is `{ "tool": "store_secret", "key": "...", "value": "..." }`, `{ "tool": "retrieve_secret", "key": "..." }`, or `{ "tool": "list_keys" }`. JSON-RPC-style items (`{ "method": "tools/call", "params": { "name", "arguments" } }`) are also accepted. | | `query` | string | No | A single command as a JSON string — either a simple object like `{"tool":"store_secret","key":"k","value":"v"}` or a raw JSON-RPC line. Use `commands` for batches. | #### Example input ```json { "passphrase": "correct horse battery staple", "commands": [ { "tool": "store_secret", "key": "api_token", "value": "sk-live-abc123" }, { "tool": "store_secret", "key": "db_pw", "value": "p@ssw0rd" }, { "tool": "list_keys" }, { "tool": "retrieve_secret", "key": "api_token" } ] } ```` *** ### Output For each command, one row is pushed to the default **dataset** with this shape: | Field | Type | Description | |-------|------|-------------| | `tool` | string | The tool that ran (`store_secret`, `retrieve_secret`, `list_keys`). | | `key` | string | The affected key (when applicable). | | `value` | string | The decrypted value (for a successful `retrieve_secret`), the key list (for `list_keys`), or `NOT_FOUND`. Absent for `store_secret`. | | `status` | string | `success` or `error`. | | `message` | string | Human-readable status / error description. | A combined `{ "results": [...] }` object is also written to the default key-value store under the key `OUTPUT`. **Example output row (retrieve):** ```json { "tool": "retrieve_secret", "key": "api_token", "value": "sk-live-abc123", "status": "success", "message": "Decrypted secret for key: api_token" } ``` The **encrypted vault** itself is stored in the named key-value store `secure-local-memory-vault` under the record `ENCRYPTED_VAULT` (a map of key → base64 ciphertext). Plaintext values are never written there. *** ### Running as a local MCP server (stdio mode) Run with no `commands`/`query` and pipe JSON-RPC requests on stdin: ```bash SLM_PASSPHRASE="correct horse battery staple" node src/main.js ``` Then send newline-delimited JSON-RPC, e.g.: ```json {"jsonrpc":"2.0","id":1,"method":"tools/list"} {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"store_secret","arguments":{"key":"k","value":"v"}}} {"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"retrieve_secret","arguments":{"key":"k"}}} ``` Each request gets a JSON-RPC response on stdout. *** ### Setup / auth - **No third-party API keys.** The only credential is your `passphrase` (or `SLM_PASSPHRASE`), which never leaves the actor. - Encryption uses Node's built-in `crypto` module — no extra dependencies beyond the Apify SDK. *** ### Limitations - The vault persists in the named key-value store `secure-local-memory-vault`. If you run this actor on a different account/store or that store is deleted, the data is gone. There is no external/shared database. - **If you lose the passphrase, the data is unrecoverable** — by design. There is no recovery mechanism or backdoor. - The passphrase is supplied via input/env. Use Apify's secret input handling and treat the actor run logs accordingly; do not log secret values yourself. - This is a single-vault, single-passphrase design. It is not a multi-tenant secrets manager and does not do key rotation, sharing, or access control beyond the passphrase. - All values are strings. Binary blobs must be base64/encoded by the caller. *** ### License Provided as-is. See repository for details. # Actor input Schema ## `passphrase` (type: `string`): Master passphrase used to derive the AES-256-GCM key (via scrypt). The same passphrase is required to decrypt previously stored secrets. If omitted, the actor falls back to the SLM\_PASSPHRASE environment variable. ## `commands` (type: `array`): A batch of MCP tool calls to run. Each item is an object: {"tool": "store\_secret", "key": "...", "value": "..."} or {"tool": "retrieve\_secret", "key": "..."}. Results are pushed to the dataset. ## `query` (type: `string`): Optional single command. Accepts either a raw JSON-RPC line (e.g. {"method":"tools/call",...}) or a simple JSON object like {"tool":"store\_secret","key":"k","value":"v"}. Use 'commands' for batches. ## Actor input object example ```json { "commands": [], "query": "" } ``` # Actor output Schema ## `results` (type: `string`): store\_secret / retrieve\_secret operation results # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = {}; // Run the Actor and wait for it to finish const run = await client.actor("constant_quadruped/secure-local-memory-mcp").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = {} # Run the Actor and wait for it to finish run = client.actor("constant_quadruped/secure-local-memory-mcp").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{}' | apify call constant_quadruped/secure-local-memory-mcp --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=constant_quadruped/secure-local-memory-mcp", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Secure Local Memory MCP Server", "description": "Model Context Protocol (MCP) server for encrypted local storage and memory vaults.", "version": "1.1", "x-build-id": "tQCfb7i1rnoT9IhJd" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/constant_quadruped~secure-local-memory-mcp/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-constant_quadruped-secure-local-memory-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/constant_quadruped~secure-local-memory-mcp/runs": { "post": { "operationId": "runs-sync-constant_quadruped-secure-local-memory-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/constant_quadruped~secure-local-memory-mcp/run-sync": { "post": { "operationId": "run-sync-constant_quadruped-secure-local-memory-mcp", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "passphrase": { "title": "Encryption passphrase", "type": "string", "description": "Master passphrase used to derive the AES-256-GCM key (via scrypt). The same passphrase is required to decrypt previously stored secrets. If omitted, the actor falls back to the SLM_PASSPHRASE environment variable." }, "commands": { "title": "MCP commands", "type": "array", "description": "A batch of MCP tool calls to run. Each item is an object: {\"tool\": \"store_secret\", \"key\": \"...\", \"value\": \"...\"} or {\"tool\": \"retrieve_secret\", \"key\": \"...\"}. Results are pushed to the dataset.", "default": [] }, "query": { "title": "Single raw JSON-RPC / command query (optional)", "type": "string", "description": "Optional single command. Accepts either a raw JSON-RPC line (e.g. {\"method\":\"tools/call\",...}) or a simple JSON object like {\"tool\":\"store_secret\",\"key\":\"k\",\"value\":\"v\"}. Use 'commands' for batches.", "default": "" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```