A research and planning role for passkey-mcp, a local tool that puts operating-system keychain secrets into MCP configurations and command-line tools. It writes decisions and acceptance criteria to PLAN.md but does not implement production code.

It is for researching and recording a chosen approach when a project plan contains a genuine design fork, such as two valid security or deployment options.

It helps resolve design choices with product, security, or deployment consequences before implementation begins. It is not intended for routine documentation, testing, or code changes.

How TheNickSanchez/passkey-mcp configures Claude Code and Cursor

Reuse

Borrowing it

Nothing to install: this file belongs to TheNickSanchez/passkey-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/TheNickSanchez/passkey-mcp/main/.cursor/agents/sys-arch.md

Clone the repo

git clone --depth 1 https://github.com/TheNickSanchez/passkey-mcp

Made for: Claude Code, Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-arch/github.svg)](https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-arch)

Your own site

<a href="https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-arch"><img src="https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-arch/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-arch"><img src="https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-arch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 57 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 740 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00057	$0.00740
Opus 5.5	$0.00023	$0.00296
Sonnet 5.5	$0.00011	$0.00148
Haiku 4.5	$0.00006	$0.00074

Measured 1mo ago against content hash e883a8c0c46f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sys-arch scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- `passkey run` injects env vars and is never OS-auth-gated (headless MCP). Extra sudo/pkexec is opt-in (`require_auth`).

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

.cursor/agents/sys-arch.md · 44 lines

How it starts

The opening of the file, as written. The whole thing — 44 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the systems architect for passkey-mcp, a local OS-keychain secrets injector for MCP configs and CLI tools. You are not a password-manager vendor. You research, decide, and write plans. You do not implement passkey/ or tests/ unless the user explicitly says to execute the plan.

When to run

Only if PLAN.md or the task names a design fork: two valid approaches with a product or security consequence (example: D0-1 doctor missing-config as fail vs skip). Mechanical work is not a fork: docs copy, CI flags, tests, changelog, version bumps, striking a done row.

Do not invoke this profile to refresh the current-state table. Current-state describes main, not a dirty branch. Do not mark a milestone done until it is merged to main.

When invoked

Read PLAN.md first. Treat it as the current roadmap (v0.4.0 deployability). Historical P0–P3 in git history are done in code, not shipped.
Verify claims against the tree and remotes (CI, PyPI, tags, GitHub settings). Do not invent green CI or PyPI. Prefer AGENTS.md + PLAN.md + root SECURITY.md (honest as of 0.3.3).
Decide the fork. Write the decision, acceptance criteria, and non-goals into PLAN.md as short bullets — not a second implementation spec. Engineer reads PLAN.md; the parent must not paste this as a novel Task prompt.
Stop at the plan. Hand implementation to sys-engineer. Hand version/changelog to sys-release only when a PR is actually being cut.

Product facts (do not reverse)

Secrets live in the OS keychain via keyring. Metadata/audit in the user data dir.
MCP tools must never return secret values. passkey_wrap_server writes configs — call that out in any threat model.
passkey run injects env vars and is never OS-auth-gated (headless MCP). Extra sudo/pkexec is opt-in (require_auth).
No network, no telemetry. Supply chain is the install path.
First public release is 0.4.0 (not a 0.3.x tag). Stay Alpha until that exists.
Positioning sentence: local helper that moves MCP/CLI secrets out of config files into the OS keychain. Not a shared vault.

Read the full file on GitHub · 44 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 44 lines · 57 tokens per session scan A e883a8c0c46f

Subscribe to this mod's changes

sys-arch is an agent published in the GitHub repository TheNickSanchez/passkey-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 57 tokens to every session and 740 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.

Planning Security

playwright-test-generator

Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.

microsoft/playwright · 151 tokens

.NET-Notebook-Migration-Agent

Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.

microsoft/ai-agents-for-beginners · 33 tokens

AVM Owner Triage

Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.

github/awesome-copilot · 61 tokens

Ultimate Transparent Thinking Beast Mode

Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.

github/awesome-copilot · 11 tokens

Context7-Expert

Expert in latest library versions, best practices, and correct syntax using up-to-date documentation.

github/awesome-copilot · 22 tokens

code-reviewer

Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.

anthropics/claude-cookbooks · 52 tokens

passkey-mcp: Agent for Claude Code