Mmcp.market

q-ring MCP server

by I4cTime·io.github.I4cTime/q-ring·v0.17.6
No reviews yet

OS keychain secrets for AI coding agents, over MCP.

C65/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C65/100

full report

Adoption
Growing

5 stars382 downloads/wk

Reviews

Write one

Nobody has reviewed q-ring yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

q-ring tools (44, 4 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • agent_forget
  • agent_recall
  • agent_remember
  • agent_scan
  • analyze_secrets
  • audit_log
  • check_policy
  • check_project
  • ci_validate_secrets
  • delete_secretwrite action
  • detect_anomalies
  • detect_environment
  • disentangle_secrets
  • entangle_secrets
  • env_generate
  • exec_with_secrets
  • export_audit
  • export_secrets
  • generate_secret
  • get_policy_summary
  • get_project_context
  • get_secret
  • has_secret
  • health_check
  • import_dotenv
  • inspect_secret
  • lint_files
  • list_hooks
  • list_providers
  • list_secrets
  • register_hook
  • remove_hookwrite action
  • rotate_secret
  • scan_codebase_for_secrets
  • set_secret
  • status_dashboard
  • teleport_pack
  • teleport_unpack
  • tunnel_createwrite action
  • tunnel_destroywrite action
  • tunnel_list
  • tunnel_read
  • validate_secret
  • verify_audit_chain

Public scan report

scanner v0.1.9 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high
  • Code scan7 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/index.js: …= "win32" ? "start" : "xdg-open"; exec(`${openCmd} ${url}`); } const shutdown = () =>…
Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the q-ring repository's README, as published. We do not edit it. Read it on GitHub

q-ring

OS keychain secrets for AI coding agents, over MCP.

Stop pasting API keys into plain-text .env files or wrestling with clunky secret managers. q-ring securely anchors your credentials to your OS's native vault (macOS Keychain, Linux Secret Service, Windows Credential Vault) and supercharges them with mechanics from quantum physics.

📖 View the Official Documentation for a complete CLI reference, MCP prompt cookbooks, and architecture details.

Why q-ring?

  • Superposition: Store one key with multiple states (dev/staging/prod) that collapse based on context.
  • Entanglement: Link keys across projects so rotating one automatically updates them all.
  • Tunneling: Create ephemeral, in-memory secrets that self-destruct after a set time or read count.
  • Teleportation: Securely pack and share AES-256-GCM encrypted secret bundles.
  • Seamless AI Integration: 44 built-in MCP tools for native use in Cursor, Kiro, and Claude Code.

🚀 Installation

q-ring is designed to be installed globally so it's available anywhere in your terminal. Pick your favorite package manager:

# pnpm (recommended)
pnpm add -g @i4ctime/q-ring

# npm
npm install -g @i4ctime/q-ring

# yarn
yarn global add @i4ctime/q-ring

# Homebrew (macOS / Linux)
brew install i4ctime/tap/qring

Docker (MCP server)

The repo ships a Dockerfile that builds the MCP server and exposes it through mcp-proxy — useful for hosted MCP deployments (e.g. Glama) or keeping the server off the host entirely:

git clone https://github.com/I4cTime/q-ring.git
cd q-ring
docker build -t qring-mcp .
docker run --rm -p 8080:8080 qring-mcp

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-09-19restoreF → Cscore 65: Shell command built from a string (injection risk)

Install directly

Runs npx -y @i4ctime/q-ring on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add q-ring -- npx -y @i4ctime/q-ring
Add to Cursor

q-ring: common questions

Is q-ring MCP server safe?
With care: it is graded C, so read the findings first (65/100). Read the q-ring safety report
How do I install q-ring?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does q-ring need an API key?
Yes. The registry entry asks for QRING_FILE_PASSPHRASE.
Is q-ring maintained?
The last commit was 5 days ago (2026-09-16). The latest release is v0.17.6.
What can I use instead of q-ring?
Servers from other publishers that do the same job: Deja Vu MCP server.

Alternatives to q-ring

Same job from other publishers: the closest match first, then the best rated.

  • Deja Vu
    deja-vu: local memory over the session histories of thirty-three coding agents.
    A

More from I4cTime →