secenv-mcp

MCP (Model Context Protocol) server for centralized secrets management. Exposes tools to generate .env files, manage shared secrets, rotate keys, and sync to GitHub Actions.

Built on top of secenv-cli.

Tools

| Tool | Description | |------|-------------| | generate_env | Generate .env from .env.example + central secrets | | list_projects | List all projects in secrets.json | | list_shared | List shared secret key names (values redacted) | | add_secret | Add or update a project secret | | rotate_secret | Rotate a shared secret, reports affected projects | | sync_github | Sync secrets to GitHub Actions via gh CLI |

Quick Start

Prerequisites

1. A private Git repo with secrets.json (see secenv-cli docs)
2. Run npx secenv-cli --init <your-private-repo-url> once to set up

Use with Cursor / Claude Desktop / Windsurf

Add to your MCP config:

{
  "mcpServers": {
    "secenv": {
      "command": "npx",
      "args": ["-y", "secenv-mcp"]
    }
  }
}

Use with Smithery

npx -y @anthropic-ai/smithery add secenv-mcp

Run as HTTP server (for Vercel / remote deployment)

npx secenv-mcp --http --port 3000

Then point your MCP client to http://localhost:3000/mcp.

Transports

| Mode | Command | Use Case | |------|---------|----------| | stdio (default) | npx secenv-mcp | Local AI clients | | HTTP | npx secenv-mcp --http | Remote deployment |

How It Works

1. Your AI agent calls a tool (e.g., generate_env)
2. The MCP server uses secenv-cli's programmatic API
3. It pulls the latest from your private secrets repo
4. Resolves .env.example against secrets.json
5. Writes .env to disk or performs the requested action

AI Agent (Cursor/Claude) → MCP Server → secenv-cli → Private Git Repo
                                      ↓
                                  .env / GitHub Actions

Deploy to Vercel (Free)

Create a Next.js API route:

// app/api/mcp/route.ts
import { createMcpHandler } from 'mcp-handler';
import { z } from 'zod';

// Import and register your tools here
const handler = createMcpHandler(
  (server) => {
    // Register secenv tools...
  },
  {},
  { basePath: '/api' }
);

export { handler as GET, handler as POST };

Or use the standalone HTTP mode:

npx secenv-mcp --http --port $PORT

Environment Variables

| Variable | Description | |----------|-------------| | TRANSPORT | Set to http to start in HTTP mode | | PORT | HTTP port (default: 3000) | | SECENV_REPO_URL | Git URL for auto-init on first run |

Security

• Secret values are never returned by list_shared — only key names with masked values
• All git operations use your local SSH keys
• gh secret set uses stdin — values never in process args
• The MCP server runs locally — your secrets never leave your machine

Requirements

• Node.js >= 18
• Git
• secenv-cli (installed automatically as dependency)
• GitHub CLI (gh) — only for sync_github tool

License

MIT