Skip to main content
Glama
ars-system

MCP Credentials Broker

by ars-system

MCP Credentials Broker

A secure credential management layer for Model Context Protocol (MCP) servers. Authenticate providers via browser — no hardcoded API keys, no tokens pasted into chat.

Why Use This?

If you're building MCP servers that need to access external APIs (GitHub, Google, Azure, etc.), you've probably hardcoded API keys in environment variables or pasted tokens into chat. This broker solves that by:

  • Authenticating providers via browser OAuth2 — you just log in, the broker handles the rest

  • Issuing short-lived references instead of exposing raw tokens to the agent

  • Centralizing credential management across all MCP servers in a single session

Related MCP server: OAuth MCP Server

How It Works

You say: "List my GitHub repos"

Agent:
  1. Checks if github-token is already stored
  2. If not → triggers browser OAuth flow → you log in → token stored
  3. Gets a short-lived reference to the token
  4. Resolves the reference to the actual value (never shown to you)
  5. Passes the token to your GitHub MCP tool

The agent handles all of this automatically via the included rules file — you never paste a token.

Installation

npm install @ars-system/mcp-credentials-broker

Or clone and build from source:

git clone https://github.com/ars-system/mcp-credentials-broker.git
cd mcp-credentials-broker
npm install
npm run build

Configuration

Step 1 — Get provider credentials (one-time)

The broker needs a client_id and client_secret for each provider you want to use. These are set once as environment variables — the agent never sees or asks for them.

GitHub

  1. Go to github.com/settings/developers

  2. Click OAuth AppsNew OAuth App

  3. Fill in:

    • Application name: MCP Credentials Broker (or anything)

    • Homepage URL: http://localhost

    • Authorization callback URL: http://localhost:9876/oauth/callback

  4. Click Register application

  5. Copy the Client ID

  6. Click Generate a new client secret and copy it

GITHUB_CLIENT_ID=your-client-id
GITHUB_CLIENT_SECRET=your-client-secret

Google

  1. Go to console.cloud.google.com/apis/credentials

  2. Click Create CredentialsOAuth client ID

  3. Application type: Web application

  4. Add to Authorized redirect URIs: http://localhost:9876/oauth/callback

  5. Copy the Client ID and Client Secret

GCP_CLIENT_ID=your-client-id
GCP_CLIENT_SECRET=your-client-secret

Azure

  1. Go to portal.azure.comAzure Active DirectoryApp registrations

  2. Click New registration

  3. Name it anything, select Accounts in any organizational directory and personal Microsoft accounts

  4. Set redirect URI to: http://localhost:9876/oauth/callback (type: Web)

  5. After creation, go to Certificates & secretsNew client secret

  6. Copy the Application (client) ID and the secret value

AZURE_CLIENT_ID=your-client-id
AZURE_CLIENT_SECRET=your-client-secret

Okta

  1. Go to your Okta Admin Console → ApplicationsCreate App Integration

  2. Select OIDC - OpenID ConnectWeb Application

  3. Add http://localhost:9876/oauth/callback to Sign-in redirect URIs

  4. Copy the Client ID and Client Secret

  5. Also set your Okta domain:

OKTA_CLIENT_ID=your-client-id
OKTA_CLIENT_SECRET=your-client-secret
OKTA_DOMAIN=your-org.okta.com

Step 2 — Configure your MCP client

Add the broker alongside your other MCP servers. Pass the provider env vars in the env block:

{
  "mcpServers": {
    "credentials-broker": {
      "command": "node",
      "args": ["/path/to/mcp-credentials-broker/dist/index.js"],
      "env": {
        "GITHUB_CLIENT_ID": "your-github-client-id",
        "GITHUB_CLIENT_SECRET": "your-github-client-secret",
        "GCP_CLIENT_ID": "your-gcp-client-id",
        "GCP_CLIENT_SECRET": "your-gcp-client-secret"
      }
    },
    "your-github-mcp": {
      "command": "node",
      "args": ["/path/to/your-github-mcp/dist/index.js"]
    }
  }
}

Only configure the providers you actually use. You don't need all of them.


Step 3 — Add the agent rules (for Amazon Q / Claude / Cursor)

Add the following rules to your agent configuration (e.g., in .amazonq/rules/credentials-broker.md or your agent's custom rules file). These rules ensure the agent always uses the broker automatically and never asks you for tokens.

Copy the entire section below:

# Credentials Broker — Agent Rules

You have access to a `credentials-broker` MCP server. Follow these rules strictly.

## Rule 1 — Never ask the user for API tokens, passwords, or secrets

If a task requires a token (GitHub, Google, Azure, AWS, etc.), use the broker to obtain it.
Never ask the user to paste a token into the chat.

## Rule 2 — Check if a token is already stored before authenticating

Before triggering an OAuth flow, always check if the token already exists:

get_secret(name: "-token", purpose: "check")


If it succeeds, use that reference. Only call `start_oauth_flow` if the secret is missing or expired.

## Rule 3 — OAuth flow requires no credentials from the user

Call `start_oauth_flow` with only `provider`, `scopes`, and `secret_name`.
The broker reads `client_id` and `client_secret` from its own environment — you must NOT ask the user for these.

start_oauth_flow( provider: "github", scopes: ["repo", "read:user"], secret_name: "github-token" )


Tell the user: "A browser window will open for you to log in. Come back here once done."

## Rule 4 — Standard token retrieval pattern

Every time you need a token to pass to another MCP tool, follow this exact sequence:

**Step 1** — Get a short-lived reference:

get_secret(name: "github-token", purpose: "<what you're doing>", ttl_seconds: 3600) → returns { reference: { id: "ref-uuid" } }


**Step 2** — Resolve the reference to the actual value:

resolve_secret(reference_id: "ref-uuid") → returns { value: "gho_actualtoken..." }


**Step 3** — Pass `value` to the target MCP tool's token/auth parameter.

## Rule 5 — Never log or display raw token values

After calling `resolve_secret`, use the value directly in the next tool call.
Do not print it, summarize it, or include it in any response to the user.

## Rule 6 — Naming convention for stored secrets

Use consistent names so tokens can be reused across tool calls in the same session:

| Provider | secret_name        |
|----------|--------------------|
| GitHub   | `github-token`     |
| Google   | `google-token`     |
| Azure    | `azure-token`      |
| Okta     | `okta-token`       |
| Custom   | `<service>-token`  |

## Rule 7 — Provider configuration errors

If `start_oauth_flow` fails with "not configured", tell the user:
> "The broker needs `<PROVIDER>_CLIENT_ID` and `<PROVIDER>_CLIENT_SECRET` set as environment variables where the broker is running. These are set once by you — I won't ask for them again."

## Summary flow

Need a token? └─ get_secret("github-token") → exists? → resolve_secret → use it → missing? → start_oauth_flow → get_secret → resolve_secret → use it


Available Tools

start_oauth_flow

Opens the browser for you to log in. Stores the resulting token under secret_name. No credentials needed from you — the broker reads client_id and client_secret from its environment.

Parameter

Required

Description

provider

yes

github, google, azure, okta, oauth2

scopes

yes

List of OAuth2 scopes to request

secret_name

yes

Name to store the token under

authorization_endpoint

no

Custom auth URL (only for okta / oauth2)

token_endpoint

no

Custom token URL (only for okta / oauth2)

{
  "provider": "github",
  "scopes": ["repo", "read:user"],
  "secret_name": "github-token"
}

get_secret

Issues a short-lived reference to a stored secret. Returns a reference ID, not the raw value.

Parameter

Required

Description

name

yes

Name of the stored secret

purpose

yes

Why you're requesting it (for audit)

ttl_seconds

no

How long the reference is valid (default: 3600)

{
  "name": "github-token",
  "purpose": "listing repositories",
  "ttl_seconds": 3600
}

Response:

{
  "reference": {
    "id": "ref-uuid",
    "name": "github-token",
    "expiresIn": 3600
  }
}

resolve_secret

Resolves a reference ID to the actual token value. Used by the agent immediately before passing the token to another MCP tool.

Parameter

Required

Description

reference_id

yes

The id returned by get_secret

{ "reference_id": "ref-uuid" }

Response:

{ "value": "gho_actualtoken..." }

store_secret

Manually store a secret (e.g. a static API key). Use get_secret + resolve_secret to retrieve it later.

Parameter

Required

Description

name

yes

Identifier for the secret

value

yes

The secret value

tags

no

Key-value tags for organization


mint_token

Generates a short-lived JWT-based token scoped to a provider. Useful when you want a broker-issued token rather than a raw OAuth token.

Parameter

Required

Description

provider

yes

github, aws, gcp, azure, oauth2, okta

scopes

yes

List of scopes/permissions

resource

no

Resource identifier

ttl_seconds

no

Token lifetime (default: provider default)


revoke_token

Immediately invalidates a minted token.

Parameter

Required

Description

token_id

yes

ID of the token to revoke


get_broker_stats

Returns counts of active tokens, active references, and stored secrets.


End-to-End Example

You:   "Create a GitHub issue in my repo"

Agent: 1. get_secret("github-token")           → not found
       2. start_oauth_flow(                     → browser opens
            provider: "github",
            scopes: ["repo"],
            secret_name: "github-token"
          )                                     → you log in → token stored
       3. get_secret("github-token",            → { id: "ref-abc" }
            purpose: "create issue")
       4. resolve_secret("ref-abc")             → { value: "gho_..." } ← never shown to you
       5. github-mcp/create_issue(              → issue created ✓
            token: "gho_...",
            title: "..."
          )

Provider TTL Limits

Provider

Default TTL

Max TTL

GitHub

1 hour

8 hours

AWS

1 hour

12 hours

GCP

1 hour

12 hours

Azure

1 hour

12 hours

Okta

1 hour

12 hours

OAuth2 (generic)

1 hour

24 hours


Architecture

┌──────────────────────────────────────────────────────┐
│                MCP Credentials Broker                │
├──────────────────────────────────────────────────────┤
│                                                      │
│  ┌─────────────────────────────────────────────┐    │
│  │           OAuth Web Flow                    │    │
│  │  - Spins up local HTTP server on :9876      │    │
│  │  - Opens browser to provider auth URL       │    │
│  │  - Receives callback with auth code         │    │
│  │  - Exchanges code for access token          │    │
│  └─────────────────────────────────────────────┘    │
│                                                      │
│  ┌─────────────────────────────────────────────┐    │
│  │           Credentials Manager               │    │
│  │  - In-memory secret storage                 │    │
│  │  - Short-lived reference issuance           │    │
│  │  - Token lifecycle & auto-expiry            │    │
│  │  - Provider config from env vars            │    │
│  └─────────────────────────────────────────────┘    │
│                                                      │
│  ┌─────────────────────────────────────────────┐    │
│  │           MCP Server Interface               │    │
│  │  - Tool definitions & request handling      │    │
│  └─────────────────────────────────────────────┘    │
│                                                      │
└──────────────────────────────────────────────────────┘

Security Notes

  • Tokens are stored in memory only — they are lost when the broker process restarts

  • Raw token values are never returned by get_secret — only reference IDs

  • The agent rule file instructs the agent to never display resolved token values

  • Set JWT_SECRET env var in production to sign broker-issued tokens securely

  • The OAuth callback server only runs during an active start_oauth_flow call, then shuts down


Development

npm run watch   # TypeScript watch mode
npm run build   # Build
npm run dev     # Build + run
npm run lint    # Lint

Contributing

Contributions welcome! Please follow existing TypeScript patterns and maintain proper type definitions.

License

MIT — see LICENSE file for details

Resources


Built by @ars-systemReport Issues

Available Tools

7 tools
get_broker_statsA

Get statistics about the credentials broker including active tokens, secret references, and audit log summary.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It implies a read-only operation ('Get statistics') and lists what data is returned, but does not explicitly state side effects, permission requirements, or whether it is safe. The context is useful but leaves some ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that conveys the tool's purpose without unnecessary words. It is concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no parameters and no output schema, the description provides a reasonable overview of the return content. It mentions three key categories, which is adequate, though it could be more explicit about the response format or exact metrics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, so the baseline is 4. The description does not need to add parameter details, and the schema is fully covered vacuously.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get statistics about the credentials broker' with specific items (active tokens, secret references, audit log summary). This is a specific verb+resource and distinguishes it from sibling tools that focus on individual secret/token operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool vs alternatives. It simply describes what it does, without any explicit context, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_secretA

Issues a short-lived secret reference for a stored secret. Returns a reference ID (not the raw secret) with an expiry time. The reference can be used to retrieve the actual secret value within the TTL period.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesName of the secret to retrieve
purposeYesPurpose for which the secret is being requested
ttl_secondsNoTime-to-live in seconds for the secret reference (default: 3600)

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It discloses a critical behavior—returning a reference ID instead of the raw secret—and mentions expiry/TTL, which is essential given the tool name. It does not cover permissions, error handling, or side effects, but the key behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the primary behavior and return value. Every sentence adds value, with no redundant or extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must explain return values; it does so by stating a reference ID and expiry time. It covers the essential behavior and TTL mechanism, though it does not detail return structure or error cases. The required parameters are documented in the schema, so the description is adequately complete for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description mentions TTL period, aligning with the schema, but adds no additional semantic detail beyond what the property descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('issues') and resource ('short-lived secret reference'), clearly stating the tool's function. It distinguishes itself from siblings by explicitly noting it returns a reference ID rather than the raw secret, which differentiates it from tools like resolve_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by explaining that the reference can be used to retrieve the actual secret within the TTL, suggesting a companion tool. However, it does not explicitly name alternatives or state when not to use this tool, leaving the agent to infer the appropriate scenario.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mint_tokenA

Generates a short-lived, scoped token for a specific provider (OAuth, GitHub, AWS STS, GCP, Azure). The token is automatically revoked after the TTL expires.

ParametersJSON Schema
NameRequiredDescriptionDefault
scopesYesList of scopes/permissions for the token
providerYesProvider type for the token
resourceNoOptional resource identifier the token is for
ttl_secondsNoTime-to-live in seconds for the token (default: provider default)

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and discloses meaningful lifecycle behavior: the token is short-lived and automatically revoked after the TTL expires. This goes beyond the schema, though it does not mention permissions or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core action, and contains no filler. Every phrase contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no output schema and no annotations, so the description should cover return value/behavior, but it only defines the token's lifecycle. It omits what the tool returns (e.g., the token string) and error conditions, making it adequate but not fully complete for a 4-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter is already documented. The description adds context around 'scoped' and 'TTL expires,' which loosely connects to scopes and ttl_seconds, but it does not provide deeper syntax or formatting details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Generates') plus a concrete resource ('short-lived, scoped token') and enumerates target providers. This clearly distinguishes it from sibling tools like revoke_token or get_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when a short-lived, scoped token for a specific provider is needed. However, it does not explicitly contrast with alternatives like start_oauth_flow or revoke_token, leaving usage guidance mostly implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resolve_secretA

Resolve a secret reference ID (from get_secret) to get the actual token value. Use this to pass the real token to another MCP tool.

ParametersJSON Schema
NameRequiredDescriptionDefault
reference_idYesThe reference ID returned by get_secret

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It states the action (resolve) and the result (actual token value), which implies a read operation. However, it does not disclose that the token is sensitive or that handling it has security implications—context an agent might need for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, first states the core action and source, second gives a concrete usage scenario. No redundant information; every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description is nearly complete: purpose, source, and usage are covered. It could mention that the returned token is sensitive and should be handled cautiously, but that is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single parameter (reference_id) as returned by get_secret, so baseline 3 applies. The description adds no additional semantic detail beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: resolving a secret reference ID to the actual token value. It specifies the source (from get_secret) and distinguishes it from sibling tools like store_secret or mint_token.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains when to use the tool: when you need the real token to pass to another MCP tool. It does not explicitly rule out alternatives, but the context is clear enough for an agent to know this is the intended resolution step.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

revoke_tokenA

Immediately revokes a previously issued token, making it invalid for any further use.

ParametersJSON Schema
NameRequiredDescriptionDefault
token_idYesID of the token to revoke

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the burden. It discloses the immediate effect and that the token becomes invalid, but does not mention whether revocation is irreversible, idempotent, or requires specific permissions. Some behavioral information is provided but gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It efficiently conveys the action and consequence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description covers the core purpose and effect. It lacks explicit usage guidelines and edge-case behavior, but is largely sufficient for an agent to understand the tool's role. Slightly above adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter token_id is fully documented in the schema with 100% coverage, so the description adds no additional semantic meaning beyond what the schema provides. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: revoking a previously issued token. The verb 'revokes' is specific and the resource 'token' is explicit, distinguishing it from sibling tools like 'mint_token'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used after a token has been issued ('previously issued token'), but does not explicitly state when to use it over alternatives or mention any prerequisites or exclusions. Usage context is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_oauth_flowA

Authenticate a provider via browser-based OAuth2 web flow. Opens the browser for the user to log in — no client_id or client_secret needed from you. Stores the resulting access token under secret_name for use with get_secret/resolve_secret.

ParametersJSON Schema
NameRequiredDescriptionDefault
scopesYesList of OAuth2 scopes to request (e.g. ['repo', 'read:user'] for GitHub)
providerYesOAuth2 provider to authenticate with
secret_nameYesName to store the access token under. Use this name with get_secret/resolve_secret later.
token_endpointNoCustom token URL — only needed for okta or generic oauth2 providers
authorization_endpointNoCustom authorization URL — only needed for okta or generic oauth2 providers

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the transparency burden. It discloses that the tool opens a browser, requires no client credentials from the user, and stores the access token under a secret_name. It lacks details about output/return behavior and overwrite semantics, but covers core side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action, no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description adequately explains the tool's purpose and side effects, but doesn't mention what the tool returns or failure behavior. It's a reasonable but not exhaustive description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all five parameters. The description adds minimal extra parameter context, such as how secret_name is used with get_secret/resolve_secret, but the schema already documents parameters thoroughly. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool authenticates a provider via browser-based OAuth2 web flow, distinguishing it from sibling secret management tools like get_secret and store_secret. It also explains the token storage for later retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It implies usage by noting no client_id or client_secret is needed and that the token is stored for use with get_secret/resolve_secret. However, it doesn't explicitly compare to alternatives or state exclusions, so it's not as strong as the calibration best case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

store_secretA

Store a secret in the credentials broker. This secret can then be referenced using get_secret.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesName/identifier for the secret
tagsNoOptional tags for organizing secrets
valueYesThe secret value to store

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden for behavioral disclosure. It only states the basic store action and a reference workflow, but does not reveal key behaviors such as whether existing secrets are overwritten, any permission requirements, or what the response/return value looks like. This is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long and immediately communicates the core action and a key follow-up usage. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple store operation, the description explains the purpose and how the stored secret is consumed. However, without annotations or an output schema, it lacks information on edge cases (e.g., overwriting, errors) and security context, making it adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter (name, value, tags) already having a description. The tool description adds no extra parameter-level detail, so the baseline of 3 applies because the schema carries the explanatory weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Store' and the resource 'a secret in the credentials broker', making the tool's purpose unambiguous. It also distinguishes from siblings by noting the secret can later be referenced with get_secret, which positions store_secret as the write counterpart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by indicating the workflow: store a secret, then reference it via get_secret. However, it does not explicitly state when NOT to use this tool or discuss alternatives like mint_token or revoke_token, so it stops short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.1/5.0
Disambiguation5/5

Each tool targets a distinct operation: storage, reference issuance, reference resolution, token minting, token revocation, OAuth initiation, and stats. The two-step get_secret/resolve_secret flow is clearly distinguished by their descriptions, and mint_token vs start_oauth_flow differentiate direct minting from interactive OAuth.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., get_secret, mint_token, revoke_token, start_oauth_flow, get_broker_stats). No mixed conventions.

Tool Count5/5

7 tools is well-scoped for a credentials broker, covering core operations without redundancy or bloat.

Completeness4/5

The surface covers the full lifecycle of storing, referencing, resolving, minting, and revoking credentials, plus OAuth and stats. Minor gaps include lack of explicit delete/update for secrets or a listing API, but the core workflows are complete.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    An MCP server that exposes tools for issuing scoped agent credentials, delegating narrower child credentials, handling approvals, revoking task trees, and retrieving audit trails and evidence packets.
    14
    1
    Apache 2.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    An MCP server for OAuth 2.0 authentication supporting Device Code and Client Credentials flows, enabling secure token management for MCP applications.
  • F
    license
    Not graded
    quality
    D
    maintenance
    A production-ready MCP server that authenticates agents via OAuth 2.1 Bearer tokens, validates JWTs with JWKS, enforces tool-level scopes and roles, and logs the full delegation chain.
  • A
    license
    Not graded
    quality
    C
    maintenance
    Encrypted-at-rest credential vault with MCP server for agent credential lookup and management.
    13
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ars-system/mcp-credentials-broker'

If you have feedback or need assistance with the MCP directory API, please join our Discord server