github_secrets_set

Instructions

Implementation Reference

• src/index.js:1887-1962 (handler)

  The main execution logic for the github_secrets_set tool. Validates the secret name format, masks the value for logging, constructs the gh secret set command, executes it using runCommand, and returns success/error messages with guidance.

    async ({ name, value, repo, env }) => {
      // Validate secret name
      if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
        return {
          content: [{
            type: "text",
            text: `Invalid secret name: "${name}"
  
  Rules:
  - Must be UPPERCASE
  - Must start with a letter
  - Can only contain A-Z, 0-9, and _
  
  Examples: API_KEY, DATABASE_URL, AWS_ACCESS_KEY_ID`
          }]
        };
      }
  
      // Warn about potentially sensitive values being logged
      const maskedValue = value.substring(0, 3) + "***" + value.substring(value.length - 3);
  
      const repoFlag = repo ? `-R ${repo}` : "";
      const envFlag = env ? `--env ${env}` : "";
  
      // Use echo with pipe to avoid showing value in process list
      const result = await runCommand(
        `echo "${value.replace(/"/g, '\\"')}" | gh secret set ${name} ${repoFlag} ${envFlag}`,
        { timeout: 30000 }
      );
  
      if (!result.success) {
        let help = "";
        if (result.stderr?.includes("unauthorized") || result.stderr?.includes("401")) {
          help = "\n\nAuthentication issue. Try: gh auth login";
        } else if (result.stderr?.includes("404") || result.stderr?.includes("not found")) {
          help = "\n\nRepository not found. Check the repo name or make sure you have access.";
        }
  
        return {
          content: [{
            type: "text",
            text: `Failed to set secret!\n\nError: ${result.stderr || result.error}${help}`
          }]
        };
      }
  
      const location = env ? `environment "${env}"` : "repository";
  
      return {
        content: [{
          type: "text",
          text: `Secret set successfully!
  
  Name: ${name}
  Value: ${maskedValue}
  Location: ${location}${repo ? ` (${repo})` : ""}
  
  TO USE IN GITHUB ACTIONS:
  \`\`\`yaml
  env:
    MY_VAR: \${{ secrets.${name} }}
  
  # Or in a step:
  - name: Use secret
    run: echo "Using secret"
    env:
      ${name}: \${{ secrets.${name} }}
  \`\`\`
  
  SECURITY NOTES:
  - Secrets are encrypted and never shown in logs
  - Secrets are not passed to workflows from forks
  - Use environment secrets for production credentials`
        }]
      };
    }

• src/index.js:1881-1886 (schema)

  Input schema defining the parameters for the github_secrets_set tool: name (required string), value (required string), repo (optional string), env (optional string).

  {
    name: { type: "string", description: "Secret name (uppercase with underscores, e.g., API_KEY)" },
    value: { type: "string", description: "Secret value" },
    repo: { type: "string", description: "Repository (owner/repo format)", default: "" },
    env: { type: "string", description: "Environment name (optional, for environment-specific secrets)", default: "" }
  },

• src/index.js:1878-1964 (registration)

  MCP server.tool registration for the github_secrets_set tool, including name, description, input schema, and handler function.

  server.tool(
    "github_secrets_set",
    "Set a GitHub Actions secret (value will be securely stored)",
    {
      name: { type: "string", description: "Secret name (uppercase with underscores, e.g., API_KEY)" },
      value: { type: "string", description: "Secret value" },
      repo: { type: "string", description: "Repository (owner/repo format)", default: "" },
      env: { type: "string", description: "Environment name (optional, for environment-specific secrets)", default: "" }
    },
    async ({ name, value, repo, env }) => {
      // Validate secret name
      if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
        return {
          content: [{
            type: "text",
            text: `Invalid secret name: "${name}"
  
  Rules:
  - Must be UPPERCASE
  - Must start with a letter
  - Can only contain A-Z, 0-9, and _
  
  Examples: API_KEY, DATABASE_URL, AWS_ACCESS_KEY_ID`
          }]
        };
      }
  
      // Warn about potentially sensitive values being logged
      const maskedValue = value.substring(0, 3) + "***" + value.substring(value.length - 3);
  
      const repoFlag = repo ? `-R ${repo}` : "";
      const envFlag = env ? `--env ${env}` : "";
  
      // Use echo with pipe to avoid showing value in process list
      const result = await runCommand(
        `echo "${value.replace(/"/g, '\\"')}" | gh secret set ${name} ${repoFlag} ${envFlag}`,
        { timeout: 30000 }
      );
  
      if (!result.success) {
        let help = "";
        if (result.stderr?.includes("unauthorized") || result.stderr?.includes("401")) {
          help = "\n\nAuthentication issue. Try: gh auth login";
        } else if (result.stderr?.includes("404") || result.stderr?.includes("not found")) {
          help = "\n\nRepository not found. Check the repo name or make sure you have access.";
        }
  
        return {
          content: [{
            type: "text",
            text: `Failed to set secret!\n\nError: ${result.stderr || result.error}${help}`
          }]
        };
      }
  
      const location = env ? `environment "${env}"` : "repository";
  
      return {
        content: [{
          type: "text",
          text: `Secret set successfully!
  
  Name: ${name}
  Value: ${maskedValue}
  Location: ${location}${repo ? ` (${repo})` : ""}
  
  TO USE IN GITHUB ACTIONS:
  \`\`\`yaml
  env:
    MY_VAR: \${{ secrets.${name} }}
  
  # Or in a step:
  - name: Use secret
    run: echo "Using secret"
    env:
      ${name}: \${{ secrets.${name} }}
  \`\`\`
  
  SECURITY NOTES:
  - Secrets are encrypted and never shown in logs
  - Secrets are not passed to workflows from forks
  - Use environment secrets for production credentials`
        }]
      };
    }
  );

• src/index.js:18-25 (helper)

  Helper function runCommand used by the tool to execute shell commands safely, including timeout and error handling.

  async function runCommand(cmd, options = {}) {
    try {
      const { stdout, stderr } = await execAsync(cmd, { timeout: 30000, ...options });
      return { success: true, stdout: stdout.trim(), stderr: stderr.trim() };
    } catch (error) {
      return { success: false, error: error.message, stdout: error.stdout?.trim(), stderr: error.stderr?.trim() };
    }
  }

• src/tools.js:302-338 (handler)

  Exported handler function in tools.js (noted for testing), identical logic to the main handler.

  export async function githubSecretsSet({ name, value, repo, env }) {
    if (!/^[A-Z][A-Z0-9_]*$/.test(name)) {
      return {
        content: [{
          type: "text",
          text: `Invalid secret name: "${name}"\n\nRules:\n- Must be UPPERCASE\n- Must start with a letter\n- Can only contain A-Z, 0-9, and _`
        }]
      };
    }
  
    const maskedValue = value.substring(0, 3) + "***" + value.substring(value.length - 3);
    const repoFlag = repo ? `-R ${repo}` : "";
    const envFlag = env ? `--env ${env}` : "";
  
    const result = await commandRunner(
      `echo "${value.replace(/"/g, '\\"')}" | gh secret set ${name} ${repoFlag} ${envFlag}`,
      { timeout: 30000 }
    );
  
    if (!result.success) {
      return {
        content: [{
          type: "text",
          text: `Failed to set secret!\n\nError: ${result.stderr || result.error}`
        }]
      };
    }
  
    const location = env ? `environment "${env}"` : "repository";
  
    return {
      content: [{
        type: "text",
        text: `Secret set successfully!\n\nName: ${name}\nValue: ${maskedValue}\nLocation: ${location}`
      }]
    };
  }