sops-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SOPS_AGE_KEY | No | Age private key — required for any mutation tool (rotate, add, update, rename, delete) | |
| SOPS_MCP_HOST | No | Bind host for SSE transport | 127.0.0.1 |
| SOPS_MCP_PORT | No | Bind port for SSE transport | 55090 |
| SOPS_MCP_API_TOKEN | No | API token for SSE authentication. Required when SSE transport binds to 0.0.0.0. | |
| SOPS_MCP_LOG_LEVEL | No | Log level | WARNING |
| SOPS_MCP_TRANSPORT | No | Transport: stdio or sse | stdio |
| SOPS_AGE_RECIPIENTS | No | Alternative to SOPS_MCP_AGE_PUBLIC_KEY. Must be set if SOPS_MCP_AGE_PUBLIC_KEY is not set. | |
| SOPS_MCP_SOPS_BINARY | No | Path to sops binary | sops |
| SOPS_MCP_ALLOWED_HOSTS | No | Comma-separated allowlist for the SSE Host header (DNS rebinding protection) | 127.0.0.1,127.0.0.1:*,localhost,localhost:* |
| SOPS_MCP_AGE_PUBLIC_KEY | No | Age public key for encryption. Must be set if SOPS_AGE_RECIPIENTS is not set. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sops_create_secretsA | Generate and encrypt secrets as SOPS YAML. Returns encrypted content for the client to write to disk. Supports three sources: 'generated' (cryptographic randomness), 'external' (user-provided values), and 'derived' (computed from another key in the same file via a transform such as pbkdf2_sha512_authelia). Derived secret plaintexts are returned in the response so they can be copied into config files. |
| sops_list_secretsA | List key names and metadata from a SOPS-encrypted file. No decryption needed — reads key names from encrypted YAML and metadata from the _meta_unencrypted block. |
| sops_rotate_generatedA | Re-generate 'generated' secrets with new random values while preserving 'external' secrets. Requires SOPS_AGE_KEY env var for decryption. |
| sops_add_secretsA | Add new secrets to an existing SOPS-encrypted file. Decrypts the file, merges in new secrets, and re-encrypts — preserving all existing values and metadata. Rejects keys that already exist in the file. Supports generated, external, and derived sources. Requires SOPS_AGE_KEY env var. |
| sops_add_metadataA | Add _meta_unencrypted metadata to an existing SOPS-encrypted file that lacks it. Decrypts the file, adds metadata, and re-encrypts preserving original plaintext values. Requires SOPS_AGE_KEY env var for decryption. |
| sops_delete_secretsA | Delete one or more keys from an existing SOPS-encrypted file. Removes both the encrypted value and the _meta_unencrypted entry. Rejects deletion of keys that other derived secrets depend on unless those dependents are also in the delete list. Requires SOPS_AGE_KEY env var. |
| sops_rename_secretA | Rename a key in an existing SOPS-encrypted file. Preserves the value, source type, and metadata. Updates 'from' references in any derived secrets that depend on the renamed key. Requires SOPS_AGE_KEY env var. |
| sops_update_externalA | Replace the value of an 'external' secret (e.g. after the user rotated an upstream API key). Rejects attempts to update 'generated' or 'derived' secrets — use sops_rotate_generated for those. Recomputes any derived secrets that reference this key. Requires SOPS_AGE_KEY env var. |
| sops_create_oidc_secretA | Convenience tool: create an Authelia-compatible OIDC client secret. Generates KEY_NAME as a 64-char alphanumeric 'generated' secret AND KEY_NAME_HASH as a 'derived' PBKDF2-SHA512 hash of it, stored together in a new encrypted file. The hash is returned in the response for pasting into Authelia's configuration.yml. Equivalent to calling sops_create_secrets with one generated and one derived (pbkdf2_sha512_authelia) entry. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool has a clear, distinct purpose: adding, creating, deleting, listing, renaming, rotating, updating, or adding metadata. No two tools overlap in functionality, and descriptions clearly differentiate them.
All tools follow a consistent 'sops_verb_noun' pattern in snake_case. The verbs (add, create, delete, list, rename, rotate, update) are descriptive and uniform.
With 9 tools, the server covers the essential operations for managing SOPS-encrypted secrets without being bloated. Each tool serves a necessary and well-scoped function.
The tool set covers all major lifecycle operations: create, read (list), update (add, rename, update_external, rotate), and delete. Minor gaps exist (e.g., no explicit metadata removal tool), but the surface is largely complete for secrets management.