About Secret MCP
Secret MCP is an MCP server published by AKarenin in the Security category: allow AI to generate env files without leaking secrets.
The repository has 5 stars and 1 forks, with the last commit 10 months ago. Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.
Install
git clone https://github.com/AKarenin/Secret-mcpThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
Ask AI about Secret MCP
Powered by Claude · Grounded in docs
Security checks
Static checks derived from the repository 3 days ago. Heuristics on the source, not an audit.
- ✓README presentThe repository ships documentation.
- !License declaredNo license file. Legally you have no right to use it in a product.
- !Tests presentNo tests found. Behaviour changes may go unnoticed between versions.
- ✓Dependencies pinnedA lockfile pins dependency versions.
- ✓No dynamic code executionSource scan found no eval, dynamic Function, or shell execution.
- !Scoped permissionsDoesn't declare a permission scope. Assume it can do anything its process can.
Releases
README
Secret MCP
A desktop app for managing secrets with an MCP server that lets AI coding assistants write .env files without ever seeing the secret values.
Why?
Generating .env file is a pain, especially because there is no vibing out of it. But its an even stronger pain to leak secrets to AI coding assistants run on the cloud.
Features
- Desktop App: Simple window for managing secrets (name, description, value)
- MCP Server: Two tools for AI assistants:
search_secrets: Find secrets by name/description (never exposes values)write_env: Write secrets to.envfiles (values go straight to file, never to AI)
- Local Storage: All secrets stored locally in SQLite
- npm Package: Just
npx secret-mcp- no build required
Installation
Desktop App
Download from Releases or build from source:
npm install
npm run tauri build
MCP Server Setup
Add to your MCP client config:
"secret-mcp": {
"command": "npx",
"args": ["secret-mcp"]
}
Usage
- Open Secret MCP app
- Add your secrets (API keys, tokens, etc.)
- When coding with AI, it will automatically use
search_secretsandwrite_envto set up your.envfiles (Note: the name of the secret is the variable name in the.envfile)
MCP Tools
search_secrets
Search for secrets by name or description. Returns names and descriptions only - values are never exposed.
// Input
{ query: "openai" }
// Output
[
{ name: "OPENAI_API_KEY", description: "OpenAI API key" }
]
write_env
Write secrets to a .env file. Values go directly from your local database to the file - never passed through the AI.
// Input
{
keys: ["OPENAI_API_KEY", "DATABASE_URL"],
path: "/Users/you/project/.env"
}
// Output
"Successfully wrote 2 secret(s) to /Users/you/project/.env"
Data Storage
Secrets are stored locally:
- macOS:
~/Library/Application Support/secret-mcp/secrets.db - Linux:
~/.local/share/secret-mcp/secrets.db - Windows:
%APPDATA%/secret-mcp/secrets.db
Security
- Secret values never leave your machine (except to
.envfiles you specify) - MCP server only returns secret names and descriptions to the AI
.envfiles written with600permissions (owner read/write only)
Tech Stack
- Desktop: Tauri 2.0 + Svelte 5 + TypeScript
- MCP Server: Node.js + @modelcontextprotocol/sdk + better-sqlite3
License
MIT
README fetched from the repository 3 days ago. The original is authoritative.