Secret MCP

# Secret MCP A desktop app for managing secrets with an MCP server that lets AI coding assistants write `.env` files without ever seeing the secret values. ## Why? Generating .env file is a pain, especially because there is no vibing out of it. But its an even stronger pain to leak secrets to AI coding assistants run on the cloud. ## Features - **Desktop App**: Simple window for managing secrets (name, description, value) - **MCP Server**: Two tools for AI assistants: - `search_secrets`: Find secrets by name/description (never exposes values) - `write_env`: Write secrets to `.env` files (values go straight to file, never to AI) - **Local Storage**: All secrets stored locally in SQLite - **npm Package**: Just `npx secret-mcp` - no build required ## Installation ### Desktop App Download from [Releases](https://github.com/AKarenin/Secret-mcp/releases) or build from source: ```bash npm install npm run tauri build ``` ### MCP Server Setup Add to your MCP client config: ```json "secret-mcp": { "command": "npx", "args": ["secret-mcp"] } ``` ## Usage 1. Open Secret MCP app 2. Add your secrets (API keys, tokens, etc.) 3. When coding with AI, it will automatically use `search_secrets` and `write_env` to set up your `.env` files (Note: the name of the secret is the variable name in the `.env` file) ## MCP Tools ### search_secrets Search for secrets by name or description. Returns names and descriptions only - **values are never exposed**. ```typescript // Input { query: "openai" } // Output [ { name: "OPENAI_API_KEY", description: "OpenAI API key" } ] ``` ### write_env Write secrets to a `.env` file. Values go directly from your local database to the file - **never passed through the AI**. ```typescript // Input { keys: ["OPENAI_API_KEY", "DATABASE_URL"], path: "/Users/you/project/.env" } // Output "Successfully wrote 2 secret(s) to /Users/you/project/.env" ``` ## Data Storage Secrets are stored locally: - **macOS**: `~/Library/Application Support/secret-mcp/secrets.db` - **Linux**: `~/.local/share/secret-mcp/secrets.db` - **Windows**: `%APPDATA%/secret-mcp/secrets.db` ## Security - Secret values never leave your machine (except to `.env` files you specify) - MCP server only returns secret names and descriptions to the AI - `.env` files written with `600` permissions (owner read/write only) ## Tech Stack - **Desktop**: Tauri 2.0 + Svelte 5 + TypeScript - **MCP Server**: Node.js + @modelcontextprotocol/sdk + better-sqlite3 ## License MIT