NEUS Docs | Portable Trust Infrastructure

Three public MCP tools manage encrypted secrets tied to your NEUS Profile. Values are sealed with AES-256-GCM and never returned in plaintext through MCP. Sign in first with OAuth or a Profile access key (Auth). Use the signed-in profile context from neus_context before create or revoke.

Tool	Purpose
`neus_secret_create`	Store a named secret as an encrypted proof
`neus_secret_list`	List secret metadata (alias, qHash, type). No values
`neus_secret_revoke`	Revoke a secret proof by qHash

When signed in, omit walletAddress. Secrets bind to your profile account from neus_context.

Create (`neus_secret_create`)

{
  "alias": "OPENAI_API_KEY",
  "secretType": "single",
  "content": "<your-secret-value>"
}

Field	Notes
`walletAddress`	Optional when signed in; must match the authenticated profile account if set
`alias`	Letters, numbers, underscore; must start with a letter
`secretType`	`single` (default) or `bundle` (JSON object string in `content`)
`content`	Plaintext input. Encrypted at rest; never echoed back via MCP

List (`neus_secret_list`)

{
  "limit": 50,
  "offset": 0
}

Without Bearer auth, the tool returns an empty list and authRequired: true. It does not leak metadata.

Revoke (`neus_secret_revoke`)

{
  "qHash": "..."
}

Requires authenticated ownership of the secret proof. Omit walletAddress when signed in.

Security

Never paste secret values into chat logs or public issues.
Prefer OAuth or Profile keys in MCP config only. Do not use them in app browser bundles.
Rotate or revoke through neus_secret_revoke and re-create if a value is exposed.

Auth

How MCP sessions authenticate.

Current user

Profile lookup and refresh.

MCP

SDK

Encrypted secrets

Create (`neus_secret_create`)

List (`neus_secret_list`)

Revoke (`neus_secret_revoke`)

Security

Auth

Current user

​Create (neus_secret_create)

​List (neus_secret_list)

​Revoke (neus_secret_revoke)

​Security

Auth

Current user

Create (`neus_secret_create`)

List (`neus_secret_list`)

Revoke (`neus_secret_revoke`)

Security