keyward init & keyward wrap

keyward init

npx keyward init --template mcp
# templates: generic | mcp | next | express

Writes the env wiring (KEYWARD_URL, agent id) and a starter file that already calls kw.get(...) instead of reading a key from the environment. Pick the template that matches your stack; generic is a plain Node agent.

keyward wrap

npx keyward wrap ./my-mcp-server.ts

Adopts an existing MCP server behind the broker: it plans the change set — swap static key reads for broker calls, add the SDK dependency, write the env — and applies it without restructuring your code.

After onboarding

Register the agent in the console (Agents → it appears after its first brokered call, or register it explicitly via POST /v1/agents), add the upstream secret under Secrets, and tighten the starter wildcard policy under Policies. From there every call your server makes is scoped, expiring, and audited.