Security 🧪 Community ✓ Claude Code ✓ Claude Desktop Standalone • Keeper

Keeper Secrets Manager

Keeper Secrets Manager - read-only secret retrieval: KSM notation field queries, secret and folder discovery, masking semantics, TOTP, and least-privilege KSM application scoping

Installation

Install this plugin individually:

/plugin marketplace add wyre-technology/msp-claude-plugins --plugin keeper

Or install all MSP plugins at once:

/plugin marketplace add wyre-technology/msp-claude-plugins

Features

Application Setup
Finding Secrets
Notation Queries
Retrieving Credentials

Skills

This plugin provides 5 skills that teach Claude about Keeper Secrets Manager:

Skill	Description
`application-setup`	Building the Keeper Secrets Manager application that a Conduit connection authenticates as: what an application, a share and a client device are, how folder and record grants bound everything the connection can ever see, read-only vs editable shares, generating the base64 device configuration in the Vault UI or Keeper Commander, verifying the realised scope from the client side, and rotating or revoking a device.
`finding-secrets`	Locating the right Keeper record without reading any of them: the metadata returned by `list_secrets`, `search_secrets` and `list_folders`, how record UIDs, titles and folders relate, what `search_secrets` actually matches on (and what it silently does not), the query strings its validator rejects, and why an empty result set usually means scope rather than absence.
`notation-queries`	The KSM notation string grammar accepted by `get_field`: the three-part `<record>/<type>/<field-path>` shape, the four field-path forms (plain, indexed, property, indexed-property), `field` vs `custom_field` vs `file` selectors, how the record segment is classified as a UID or a title, which characters the validator rejects outright, and how the returned value is masked.
`retrieving-credentials`	Reading credential material out of Keeper safely: what `get_secret` returns and exactly which parts of it masking covers, the `fields` parameter, `unmask` semantics under a container deployment with no confirmation prompt, why a record's field list is not guaranteed complete, `get_totp_code` versus unmasking a TOTP seed, and the handling rules for secret material once it is in an agent transcript.
`api-patterns`	The Keeper Secrets Manager tool surface as exposed through Conduit: the nine read-only tools and their access tiers, the ten blocked tools and whether each is withheld by policy or broken upstream, the arguments stripped from `generate_password`, how the KSM application bounds everything the connection can see, the `configBase64` credential, and the error vocabulary.

Commands

Available slash commands:

Command	Description
`/find-secret`	Locate a Keeper record by description and return its UID and metadata without revealing any credential
`/scope-audit`	Report exactly what the connected Keeper KSM application can reach - folders, record counts, and record types - reading no credential values

API Reference

Base URL
Authentication
Rate Limit
Documentation

Example Usage

Locate a Keeper record by description and return its UID and metadata without revealing any credential

/find-secret

Report exactly what the connected Keeper KSM application can reach - folders, record counts, and record types - reading no credential values

/scope-audit

Using Skills

/skill keeper:application-setup

Building the Keeper Secrets Manager application that a Conduit connection authenticates as: what an application, a share and a client device are, how folder and record grants bound everything the connection can ever see, read-only vs editable shares, generating the base64 device configuration in the Vault UI or Keeper Commander, verifying the realised scope from the client side, and rotating or revoking a device.