NEW: Agent Secrets · Keep API keys out of AI prompts→

Turn your website into an interactive API for AI agents

Connect your websites, import your own custom REST & GraphQL endpoints, and resolve secrets with zero prompt leakage. mcpmaster unifies all your digital assets into one single, hosted MCP endpoint — complete with OAuth 2.1, passwordless OIDC federation, and role-based access control.

Get started freeExplore live demo↓
✓Live in under 3 minutes
✓Zero infrastructure to maintain
✓Standard Model Context Protocol

Everything Comes In. One Endpoint Goes Out.

Connect public websites, custom OpenAPI & GraphQL backends, and secret vaults. mcpmaster unifies them all into a single MCP endpoint — available as a secure authenticated gateway with full consent and identity control, or as an open public MCP endpoint ready for web AI chats and autonomous AI agents.

Unified Endpoint:
https://mcpmaster.com/api/mcp/acme
Public & Authenticated Modes
1. Everything Comes InTap to inspect
mcpmaster COREOAuth 2.1 · RLS · OIDC1 Unified MCP Stream
2. One Endpoint Goes Out
mcpmaster.com/api/mcp/acme
ClaudeCursorChatGPTWindsurfWeb ChatCI/CD
Agent Secrets VaultZero-Exposure

In-memory key/value secret resolution. Tokens are injected into process memory, never touching AI prompts.

Tool: resolve_secret_commandReady for all agents

Stop managing five different plugins, API proxies, and token keys. mcpmaster bundles your documentation search, your custom business APIs, and your secret vault into one deterministic URL.

Zero Extra Code

Connect once · Universally discoverable by every MCP-speaking assistant & tool

See the protocol in action

AI agents don't want to scrape 50kB of bloated HTML. They want instant, structured tools that return accurate answers in 40ms.

mcpmaster-protocol-nexus · live sandbox
Try a prompt:
Agent Request (MCP Client)POST /api/mcp/acme

User prompt: "What is your return policy and refund timeline?"

// Agent invokes structured tool:
{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "search_site",
    "arguments": {
      "query": "return policy refund timeline window"
    }
  }
}
MCP Host Response
38ms94% vs raw DOM scraping
Verified Source: /legal/returns-and-refundsDeterministic
{
  "content": [
    {
      "type": "text",
      "text": "Full refunds are accepted within 30 days of delivery. Items must be unopened or gently tested in original packaging. Refunds post within 3-5 business days."
    }
  ],
  "metadata": {
    "source": "/legal/returns-and-refunds",
    "verified": true,
    "last_crawled": "12m ago"
  }
}
Compatible with: Claude Desktop, ChatGPT, Cursor, Windsurf, and LangChain.Standard Model Context Protocol (MCP)

The Agentic Web: Scraping vs. MCP

Web architecture is evolving from human click-streams to autonomous agent tool calls.

✕

Traditional Web Scraping (The Old Way)

Agents guessing from raw HTML

  • ✕50kB–200kB of raw HTML boilerplate per page
  • ✕Brittle DOM selectors break whenever designs update
  • ✕Cloudflare and anti-bot captchas block agent traffic
  • ✕Hallucinated citations and unverified content
  • ✕Read-only — agents cannot perform actions or write back
Modern Standard
✓

mcpmaster Hosted Endpoint (The New Standard)

Structured JSON-RPC via Model Context Protocol

  • ✓Sub-kilobyte typed JSON-RPC payloads (0.8kB avg)
  • ✓Deterministic schema contracts (list_tools, call_tool)
  • ✓Authenticated, signed, and rate-limited endpoints
  • ✓Deterministic answers with verified URL citations
  • ✓Agents can query data or execute authorized actions

Agent Secrets: Keep Sensitive Keys Out of AI Prompts

AI agents need credentials to test and run code, but pasting raw keys causes prompt refusals and leaks secrets. Agent Secrets resolves them safely in process memory.

Agent Refusal Policies

Claude Code, Cursor, and Cline need DB passwords and API keys to run code, but modern agents increasingly refuse or reject execution when raw credentials are pasted into chats.

Chat & Shell Leakage

Even when accepted, pasting raw .env files exposes your secrets in LLM conversation logs, local shell records, and provider servers.

Zero-Exposure Resolution

Store secrets in your workspace. The CLI injects credentials directly into runtime process memory using mcpm:// URIs—zero tokens touch the model.

AI Coding Agents (Claude, Cursor, Cline)

Agents resolve secrets in memory without passing sensitive keys through the LLM context window.

LLM Context Exposure: 0 Tokens
Resolution Pipeline SimulatorClick step to inspect
Claude
Address Ref
MCP
mcpmaster
Decrypts
Process Env
0 Raw Leaks
Address: production/STRIPE_SECRET_KEY
AES-GCM Encrypted at rest
01
Agent Requests Secret Address

AI agent accesses tool catalog via MCP endpoint and requests an address reference, not raw credentials.

02
Safe CLI Invocation Returned

Unified MCP returns resolve_secret_command — keeping the raw value strictly outside the LLM context window.

03
Child Process Memory InjectionExecuting

The CLI resolver decrypts live credentials at call-time and streams them directly into child process.env.

04
Zero Disk & Context Exposure

Secret vanishes when the child command exits. Never cached on disk, never logged in chat history.

Why this matters: When an AI coding agent needs to run database migrations, run tests, or invoke an API, mcpmaster provides an isolated boundary. The model receives a CLI runner command, executes it via its shell tool, and the raw secret is injected into the child process without ever touching the model's token stream or conversation history.

Universal Address Hierarchy: workspace → project → environment → secret

Deterministic naming convention compatible with the CLI resolver, curl, and MCP tool callers.

Predictable URI Scheme
Team Key
mcpm://acme/core-api/production/DATABASE_URL

Resolves a single secret for team-shared infrastructure.

Full Environment (.env)
mcpm://acme/core-api/staging

Resolves all environment keys into standard KEY=VALUE format.

Personal Key (~me)
mcpm://acme/~me/crawler/dev/OPENAI_API_KEY

Private developer sandbox secret isolated by PostgreSQL RLS.

Why Engineers & Vibe Coders Choose Agent Secrets

Engineered specifically for the AI agent era — uncompromising privacy with zero developer friction.

Zero Prompt Exposure

Unlike traditional copy-pasted `.env` workflows, the MCP tool returns an isolated CLI command. The raw key never touches LLM context, chat memory, or vendor training logs.

AI Privacy Guarantee

CI/CD OIDC Federation

Native OpenID Connect integration for GitHub Actions and GitLab CI. Authenticate workloads via signed claims with zero long-lived static secrets stored in repository settings.

Passwordless CI/CD

Live Zero-Cache Rotation

Decrypts at call-time using AES-256-GCM envelope encryption. When you rotate a secret or revoke a machine identity, changes take effect on the very next HTTP request.

Instant Revocation

Personal & Team DX

Vibe coders get personal `~me` branches for private API keys, while teams share production environments safely gated by PostgreSQL Row-Level Security (RLS).

Granular Scoping

Everything needed for the agent-ready web

Built from the ground up for high performance, tenant isolation, and seamless agent interoperability.

Automated IngestionIntelligent Scan

Deep Site Ingestion & LLM-Ready Data

Paste your website or docs URL. Our crawler maps your pages, strips clutter, extracts structured sections, and generates clean, LLM-ready structured data automatically.

Smart Crawler
Maps entire domains with recursive link traversal and sitemap parsing.
DOM De-clutter
Strips headers, footers, and cookie banners to extract pure ground truth.
LLM-Ready Structure
Transforms raw web pages into clean, token-efficient structured markdown and callable tools.
Automated Webhooks
Triggers instant re-crawls whenever your live website or docs update.
crawler-response.json
{
  "url": "https://docs.acme.corp",
  "pages_indexed": 142,
  "sections_structured": 1280,
  "status": "active_structured_data",
  "tools_exposed": ["search_site", "get_page_content"]
}

How it works

Go from standard website to hosted, agent-ready MCP endpoint in three straightforward steps.

01

Add your website URL

Paste your website or docs domain. Our crawler indexes your content, removes boilerplate, and prepares structured embeddings.

02

Instant MCP Synthesis

mcpmaster generates a hosted Model Context Protocol endpoint complete with standard search_site and content retrieval tools.

03

Agents discover & interact

Add your endpoint to Claude Desktop, Cursor, or share it with agentic browsers. Paste the 1-line script tag to power your site chat widget.

One endpoint to rule them all. Any integration.

Copy configuration directly into Claude Desktop or Cursor, embed the chat widget, or dispatch calls via cURL.

File: ~/Library/Application Support/Claude/claude_desktop_config.jsonjson
{
  "mcpServers": {
    "my-website": {
      "url": "https://mcpmaster.com/api/mcp/acme-corp"
    }
  }
}

Everything you need to know

Have questions about Model Context Protocol, hosting, or indexing? We've got answers.

Model Context Protocol (MCP) is the open industry standard initiated by Anthropic and supported across the AI ecosystem (Claude, Cursor, ChatGPT, agentic browsers) that allows AI models to directly discover and call structured external tools. Without an MCP endpoint, AI agents have to scrape messy HTML, consume thousands of tokens, and risk hallucinating. An MCP endpoint lets agents query your site natively, cleanly, and deterministically.

Ready to be visible to the AI agent generation?

Turn your site into a machine-readable MCP endpoint in under 3 minutes. No complex infra, no ongoing maintenance.

Create your MCP endpoint free →