AI agents

• Search: The agent sees IDs, titles, vaults, categories, domains, usernames, field names and secret references. Never passwords, other hidden values, 2FA codes, card numbers or notes.
• Use: The agent runs a command with secrets in its environment (passbox_run) or writes a configuration file from a template (passbox_inject). The values go into the process or the file, never into the answer to the agent. Passbox redacts the command's output.
• Save: The agent creates a new secret (passbox_create_item), for example a token it just created. It does not get the value back.

Every use needs an approval that you give in the web app or the desktop app. There is deliberately no approval in the terminal, because the agent could answer it itself.

1. Create a service account with read access to a vault that holds only what the agent needs. Set an expiry date.
2. Install the command line.
3. Add pbx mcp to your agent (examples below).
4. Keep the Passbox web app or desktop app open on a device you are watching. That is where requests appear.

Claude Code:

claude mcp add passbox \
  --env PASSBOX_SERVER=https://app.passbox.net \
  --env PASSBOX_SERVICE_ACCOUNT_TOKEN=pbx_sa_… \
  -- pbx mcp

Use the scope for your user, not a project .mcp.json that gets committed.

Claude Desktop, Cursor and others (claude_desktop_config.json, ~/.cursor/mcp.json):

{
  "mcpServers": {
    "passbox": {
      "command": "pbx",
      "args": ["mcp"],
      "env": {
        "PASSBOX_SERVER": "https://app.passbox.net",
        "PASSBOX_SERVICE_ACCOUNT_TOKEN": "pbx_sa_…"
      }
    }
  }
}

Codex (~/.codex/config.toml):

[mcp_servers.passbox]
command = "pbx"
args = ["mcp"]
env = { PASSBOX_SERVER = "https://app.passbox.net", PASSBOX_SERVICE_ACCOUNT_TOKEN = "pbx_sa_…" }

Any client that starts MCP servers over stdio works the same way: command pbx, argument mcp and the two variables. Without a service account, pbx mcp uses your signed-in account and then needs PASSBOX_PASSWORD. We do not recommend that: the master password in a configuration file is a much bigger key.

Ask the agent, for example: "Run the migrations against staging with the staging database credentials from Passbox." The agent searches and asks, and a dialog opens in Passbox:

• a request code that the agent shows too,
• the items it wants to use,
• the exact command line or target file,
• the agent's reason, marked as its own words,
• how long the approval lasts.

Read the command line and choose Approve or Deny. Passbox signs your decision with your account key.

For several commands, the agent can ask for one approval with a list of allowed commands, such as npm run migrate * and npm test, for an hour. An approval lasts at most eight hours and ends when pbx mcp exits. Commands no approval covers are requested one by one.

Under Developer → AI agents you see open and past requests, revoke active approvals and read the log. Every action also appears in your account's activity.

Sometimes an agent really needs a value, for example to paste it into a web form. That is what passbox_reveal is for. It has several safeguards:

1. You start pbx mcp --allow-reveal. Without this option the tool does not exist.
2. Every request needs your approval with the separately ticked box Allow revealing the value to the agent.
3. For an organization's vaults, its policy must allow it. By default it is forbidden.
4. The server logs the reveal before the value is handed out.

• Redacting the output is a safety net, not a boundary. It does not catch transformed values, such as reversed ones. Your approval of the command line is the real barrier.
• An allowed program can itself send data over the network. Read command lines carefully and keep lists of allowed commands short.
• Files written with passbox_inject can be read by the agent if it runs as your user. Use passbox_run where you can.
• An agent that may run any command as your user can read its own configuration and use the token directly. It then gets exactly what the service account may do. So keep it small and restrict the agent's file access.
• Approvals on the phone are not available yet.