Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio — local v0.1 build; redemption by co-located executor, exercised on fixture transport
Certification scope
CERTIFIED(local) — FIRST-PARTY SCOPE ONLY. Eclipse Bazaar Test Bench 2026-10-25, standing card scoped re-bench #3: 13 pass, 0 na of 13 checks on the card's check lines, comprising 59/59 individual bench probes across the D7/D8 boundary battery, the identity-exemption angle set (aliasing-by-copy, self-nesting, list-wrapped envelope, list owner_approval, signature-plus-extra-material, dotted keys on secret_enroll) and the K3/D6 spot batteries. Bench history retained append-only: runs 1–3 FAILED (test-bench/results/eclipse-keyhold-mcp-2026-10-25.json, -2.json, -3.json) and stand as the record for the lines they scored; every gating defect they raised is closed on the standing card or a retained predecessor card. CEILING — read exactly: certification covers first-party leases over ONE redemption class (https_static_key), exercised on a fixture transport — live redemption against a real third-party API was NOT exercised and no real credential exists in the package. Third-party custody is NOT built and is HELD (G-COUNSEL + G-OWNER + Verity security review of the redemption component; the gate may conclude never). The v0 envelope construction (ephemeral ECDH P-256 + HKDF-SHA256 + HMAC stream/EtM) is a local reference construction for the fixture/dogfood scope; the held security review may replace it before any wider custody claim. NAME: CONDITIONAL PASS — trademark/collision screen owed before any public surface (G-TM); the descriptor always reads 'credential leases, never raw keys'. v0 uses local seed keys (keys/, gitignored, chmod 600): the private master half is read ONLY by the redemption executor, never by the MCP server.
What it does
- Scoped, expiring leases over NON-OAuth static credentials (raw API keys / PATs) under Wallet policy semantics — allowlist scope (hosts/methods/path prefixes, bounded by the enrollment), expiry, use-count cap, audience binding to one agent identity, per-lease kill switch — with an owner-held master key
- Raw keys never enter model context: a secret is sealed on the operator's own machine under the owner master public key and only the sealed envelope crosses the MCP surface; the MCP process stores ciphertext in a separate vault file and contains NO decrypt path — decryption lives only in the redemption component, which injects the credential into the outbound request after the model's view ends and returns metadata only
- No tool returns secret material: there is no secret_get and no lease_redeem (redemption is not an MCP operation) — those names refuse -32602 at the transport; lease tokens are shown once to the enrolling operator and stored hash-only
- Every T1 verb requires an ECDSA owner-signed, params-bound approval; redemption re-reads lease state synchronously (revocation/expiry/cap/audience/allowlist refusals by name, receipted to a hash-chained audit trail); two independent executor implementations ship, proving redemption is a protocol, not a runtime
- The claim is the static-key world outside any vendor runtime (Amendment A1): enrolling an OAuth-capable target renders that out-of-claim boundary in the enrollment record; third-party custody is HELD (G-COUNSEL + G-OWNER + Verity security review; may conclude never) — custody_scope=third_party refuses THIRD_PARTY_CUSTODY_HELD by name
- Descriptor law: the name never implies custody of funds and the descriptor always reads 'credential leases, never raw keys'; the non-exposure guarantee rests on allowlist serialization of the sealed envelope (closed field set, canonical re-serialization) and no-echo errors, with input key-material scanning as defense-in-depth
Tools
secret_enrolllease_issuelease_statuslease_listlease_revokeredemption_audit
Problems it addresses
- My agent needs an API key to do its job, but the raw key must never enter the model's context — it sits one prompt injection away from exfiltration
- Static keys — PATs and raw API keys — live outside the OAuth vault runtimes; they need scoped, expiring leases under an owner-held master key
- When a lease is revoked or expires, redemption must refuse synchronously — not at the next cache refresh
Not tested
- Live redemption against a real third-party API — NOT exercised; v0 acceptance runs on a fixture transport and no real credential exists in the package
- Third-party custody — NOT built and HELD (G-COUNSEL + G-OWNER + Verity security review; may conclude never); custody_scope=third_party refuses THIRD_PARTY_CUSTODY_HELD by name
- Additional redemption target classes — NOT built (per class, G-OWNER); v0 redeems exactly one class: https_static_key
- Production key custody — v0 uses local seed keys (keys/, gitignored, chmod 600); password-manager custody and rotation rehearsal are later gate decisions
- Envelope construction review — the v0 seal/open construction is a local reference construction for the fixture/dogfood scope; the held security review may replace it
- Trademark/name screen — NOT done (G-TM owed before any public surface); name is a CONDITIONAL PASS and the descriptor always reads 'credential leases, never raw keys'
Bench scorecard: test-bench/results/eclipse-keyhold-mcp-2026-10-25-4.json
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →