After building AI tools for the past year, we recently made a YouTube video on building MCP servers and realized MCP is a total game-changer. It essentially lets AI do anything by connecting to your apps. But the deeper we dove, the clearer it became that security and privacy were complete afterthoughts. Coming from backgrounds at Okta and Stripe, this made us pretty uncomfortable.
We kept seeing the same pattern: every app needs its own MCP server, each storing sensitive tokens, with minimal security controls. It felt like we were back to the early days of OAuth implementations. Functional, but scary.
How Keyboard fixes this:
- Isolated execution: Your API keys live in your own GitHub Codespace secrets, Bearer OAuth tokens in encrypted files on your machine. Your credentials stay in your trust radius
- Ephemeral environments: Codespaces can be destroyed/recreated, limiting blast radius
- Built-in access controls: GitHub's enterprise-grade security model protects your credentials
- Zero-trust architecture: Only you can access your API keys and execution environment
What makes this different:
- Real code execution: Claude can run JavaScript/Node.js with npm packages and your API credentials
- Reusable workflows: Save complex scripts as "Keyboard Shortcuts" for instant reuse
- Universal integration: One setup connects Linear, Slack, Google Workspace, GitHub, and more
- Auto-environment management: Codespaces created/managed automatically as needed
The GitHub Codespace approach came from experimental work with interactive documentation. We realized Codespaces might be the most secure place to execute these tasks - isolated, ephemeral, with enterprise-grade controls.
We need your help: If this resonates, give us a star on GitHub! We're looking for early users and contributors who want to help make MCP more powerful and more secure.
We'd love your feedback, especially if you've been experimenting with MCP yourself!
If you want to try it here is the quickstart: https://docs.keyboard.dev/getting-started/quickstart