npm package: @hlos/staamp-mcp
Description: STAAMP (Secure Trust Agent Access Management Protocol) MCP server - enables AI assistants to manage secrets without ever receiving credentials
Latest version: 0.1.1
Deprecated: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

# @hlos/staamp-mcp

**AI agents get capabilities, not credentials.**

STAAMP MCP Server enables AI assistants (Claude, Cursor, etc.) to manage secrets and authenticate to services **without ever receiving your credentials**.

## Why HLOS?

| Traditional Approach | HLOS STAAMP |
|---------------------|-------------|
| Agent receives API keys/tokens | Agent NEVER receives credentials |
| Leaked prompts = leaked secrets | Nothing to leak |
| Trust the agent with credentials | Trust only HLOS |

**The most secure credential is one the AI never touches.**

## Security Model

| Risk | How STAAMP Protects |
|------|---------------------|
| Prompt injection leaks secrets | Agent never has secrets to leak |
| Runaway agent spending | Budget envelopes with hard limits |
| Malicious action execution | Financial gating — no balance = no action |
| Screen capture exposure | Screen-invisible injection |
| Memory forensics | Token expiry + disposal (see note below) |

### Security Guarantee

HLOS backs its security with up to **$50,000 coverage** for credential breaches on paid plans. [Learn more](https://hlos.ai/security-guarantee)

## What is STAAMP?

**S**ecure **T**rust **A**gent **A**ccess **M**anagement **P**rotocol — a credential isolation protocol where:

- **Agents NEVER receive credentials** — Unlike OAuth, your passwords and tokens are never exposed to the AI
- **Screen-invisible injection** — Credentials injected directly into browsers, invisible to screen capture
- **Financial gating** — Every action checks wallet balance and budget limits
- **Token lifecycle** — Access tokens have automatic expiry and are cleared on disposal

### Memory Handling Note

JavaScript cannot guarantee true memory zeroing. The MCP client:
- **Token Expiry**: Access tokens automatically expire and are cleared after use
- **Dispose Method**: Calling `dispose()` dereferences sensitive data to aid garbage collection
- **Limitation**: Memory may persist until GC runs and could theoretically be extracted via memory dump

For highest-security deployments requiring guaranteed memory clearing, consider native Node.js addons with secure memory primitives or HSMs for key material.

## Quick Start

### Prerequisites
- Node.js >= 18.0.0
- An HLOS account ([hlos.ai](https://hlos.ai))

### Installation
```bash
npx @hlos/staamp-mcp
```

### Get Your Access Token

1. Go to [hlos.ai/settings/api](https://hlos.ai/settings/api)
2. Generate a new Access Token
3. Add to your IDE config below

### Claude Desktop

Add to `claude_desktop_config.json`:

**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
**Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
```json
{
  "mcpServers": {
    "hlos": {
      "command": "npx",
      "args": ["-y", "@hlos/staamp-mcp"],
      "env": {
        "HLOS_ACCESS_TOKEN": "your_access_token_here"
      }
    }
  }
}
```

### Cursor

Add to your Cursor MCP settings:
```json
{
  "hlos": {
    "command": "npx",
    "args": ["-y", "@hlos/staamp-mcp"],
    "env": {
      "HLOS_ACCESS_TOKEN": "your_access_token_here"
    }
  }
}
```

## Available Tools

### Secrets Management

| Tool | Description |
|------|-------------|
| `list_secrets` | List secrets with metadata |
| `check_secret_exists` | Verify secret existence |
| `get_secret_info` | Get secret details (never the value) |
| `suggest_missing_secrets` | Analyze code for missing secrets |
| `create_secret` | Request secret creation (requires approval) |
| `sync_to_platform` | Sync to Vercel, GitHub, Supabase |
| `check_health` | Secret health dashboard |

### Agent Authentication (STAAMP)

| Tool | Description |
|------|-------------|
| `request_session` | Request authenticated session injection |
| `list_sessions` | List captured sessions (no credentials exposed) |
| `check_session_status` | Check if session is valid |
| `get_totp_code` | Generate 2FA codes without exposing secret |

### Infrastructure & Spending

| Tool | Description |
|------|-------------|
| `request_capability` | Provision SMS, databases, APIs via spending gate |
| `check_wallet` | Check wallet balance and limits |
| `list_capabilities` | List available infrastructure |
| `list_envelopes` | View budget envelopes for agents |

## How STAAMP Differs from OAuth
```
Traditional OAuth/Tokens        STAAMP/HLOS
──────────────────────         ─────────────────────────
Agent receives token      →    Agent NEVER gets credentials
Agent stores/uses token   →    HLOS injects directly to service
Token in context window   →    Nothing in context to leak
Token can be extracted    →    Nothing to extract
No spending controls      →    Budget envelopes + financial gating
```

## Trust & Verification

**Open Source:** This MCP server is open source. [Audit the code](https://github.com/hlos-ai/staamp-mcp).

**Who We Are:** HLOS is built by the team behind SevenRooms ($1.2B exit) and Gilt Groupe ($250M exit). [About us](https://hlos.ai/about)

**Patents:** 3 patents filed, 37 claims protecting the STAAMP architecture.

**Security Guarantee:** Up to $50K coverage for breaches. [Details](https://hlos.ai/security-guarantee)

## Getting Started Path

We recommend a gradual trust ladder:

1. **Development** — Start with dev/test secrets
2. **Staging** — Graduate to internal tools
3. **Production** — Full trust when you're ready

No pressure. Security is about comfort, not speed.

## Links

- **Website:** [hlos.ai](https://hlos.ai)
- **Documentation:** [hlos.ai/docs](https://hlos.ai/docs)
- **Security:** [hlos.ai/security-guarantee](https://hlos.ai/security-guarantee)
- **GitHub:** [github.com/hlos-ai](https://github.com/hlos-ai)
- **Support:** support@hlos.ai

## License

MIT — See [LICENSE](./LICENSE)

---

**Built with STAAMP by [HLOS](https://hlos.ai)** — The credential layer for AI agents.