auth-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PREFECT_API_KEY | No | Prefect Cloud API key with permissions to read/write Secret blocks. Required for the prefect backend. | |
| PREFECT_API_URL | No | Prefect Cloud API URL. Required for the prefect backend. | |
| AUTH_MCP_BACKEND | No | Backend to use: 'file' (default) or 'prefect'. | file |
| AUTH_MCP_MASTER_KEY | No | Master key used to derive encryption key for the file backend. Required for the default file backend. Generate with `python -c "import secrets; print(secrets.token_urlsafe(32))"`. | |
| AUTH_MCP_VAULT_PATH | No | Path to the encrypted vault file for the file backend. Default is .auth_vault.json. | .auth_vault.json |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tasks | {
"list": {},
"cancel": {},
"requests": {
"tools": {
"call": {}
},
"prompts": {
"get": {}
},
"resources": {
"read": {}
}
}
} |
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| auth_setA | Create or update an API key / credential in the vault. Args: name: Unique name for the credential, e.g. "openai" or "stripe-live". value: The secret value (API key, token, password...). Never echoed back. description: Optional human-readable note shown in listings. Returns: Metadata for the saved credential (with a masked preview only). |
| auth_getA | Retrieve a credential value. Args:
name: Credential name.
mask: If True (default), return a masked form ( Returns: The credential value (masked or full). |
| auth_listA | List all stored credentials (names + metadata only, never values). |
| auth_searchA | Search stored credentials by name or description (metadata only). |
| auth_recommendA | Ask goose's AI to pick the best stored credential for a task. This tool uses MCP sampling: it sends the task plus the list of
available credentials (names + descriptions only — values never leave
the vault) back to goose's LLM, which returns the single best match
and the reasoning. Retrieve the value afterwards with
If the client does not support sampling, the tool degrades gracefully and returns the full list so the caller can choose manually. Args: task: What the credential will be used for, e.g. "call OpenAI to summarize this email thread". Returns:
|
| auth_deleteA | Permanently delete a credential from the vault. Args: name: Credential name. Returns: Confirmation. |
| auth_healthA | Health check for the auth-mcp server. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: set (create/update), get (retrieve value), list (enumerate metadata), search (query metadata), delete (remove), recommend (AI selection), and health (server status). No two tools perform the same action; even the related list/search/recommend are distinguished by their inputs and outputs.
All tools follow a consistent 'auth_<verb>' pattern (set, list, search, recommend, delete, get, health). The verb is always lowercase and after the namespace prefix, making the tool set predictable and easy to navigate.
Seven tools is ideal for a credential vault: it covers the full lifecycle (create, read, update/delete, list/search) plus health and an AI recommendation feature. Every tool earns its place without redundancy or bloat.
The surface fully covers credential management: creation/updating (auth_set), retrieval (auth_get), listing (auth_list), searching (auth_search), deletion (auth_delete), and an intelligent selection helper (auth_recommend). No essential operation is missing, and the workflow between recommend and get is explicitly documented.