MCP Credentials Broker
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| JWT_SECRET | No | Secret key for signing broker-issued JWT tokens (recommended in production) | |
| OKTA_DOMAIN | No | Okta domain (e.g., your-org.okta.com) | |
| GCP_CLIENT_ID | No | OAuth client ID for Google Cloud Platform | |
| OKTA_CLIENT_ID | No | OAuth client ID for Okta | |
| AZURE_CLIENT_ID | No | OAuth client ID for Azure | |
| GITHUB_CLIENT_ID | No | OAuth client ID for GitHub | |
| GCP_CLIENT_SECRET | No | OAuth client secret for Google Cloud Platform | |
| OKTA_CLIENT_SECRET | No | OAuth client secret for Okta | |
| AZURE_CLIENT_SECRET | No | OAuth client secret for Azure | |
| GITHUB_CLIENT_SECRET | No | OAuth client secret for GitHub |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_secretA | Issues a short-lived secret reference for a stored secret. Returns a reference ID (not the raw secret) with an expiry time. The reference can be used to retrieve the actual secret value within the TTL period. |
| mint_tokenA | Generates a short-lived, scoped token for a specific provider (OAuth, GitHub, AWS STS, GCP, Azure). The token is automatically revoked after the TTL expires. |
| revoke_tokenA | Immediately revokes a previously issued token, making it invalid for any further use. |
| store_secretA | Store a secret in the credentials broker. This secret can then be referenced using get_secret. |
| start_oauth_flowA | Authenticate a provider via browser-based OAuth2 web flow. Opens the browser for the user to log in — no client_id or client_secret needed from you. Stores the resulting access token under secret_name for use with get_secret/resolve_secret. |
| resolve_secretA | Resolve a secret reference ID (from get_secret) to get the actual token value. Use this to pass the real token to another MCP tool. |
| get_broker_statsA | Get statistics about the credentials broker including active tokens, secret references, and audit log summary. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a distinct operation: storage, reference issuance, reference resolution, token minting, token revocation, OAuth initiation, and stats. The two-step get_secret/resolve_secret flow is clearly distinguished by their descriptions, and mint_token vs start_oauth_flow differentiate direct minting from interactive OAuth.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., get_secret, mint_token, revoke_token, start_oauth_flow, get_broker_stats). No mixed conventions.
7 tools is well-scoped for a credentials broker, covering core operations without redundancy or bloat.
The surface covers the full lifecycle of storing, referencing, resolving, minting, and revoking credentials, plus OAuth and stats. Minor gaps include lack of explicit delete/update for secrets or a listing API, but the core workflows are complete.