poly-secret-mcp

Unified MCP server for secrets management. Provides Model Context Protocol tools for managing secrets through HashiCorp Vault and Mozilla SOPS.

Table of Contents

• Overview
• Adapters
  • HashiCorp Vault (11 tools)
  • Mozilla SOPS (7 tools)
• Requirements
• Configuration
  • Vault
  • SOPS
• Installation
• Usage
• Security Considerations
• License

Overview

poly-secret-mcp exposes secrets management capabilities through the Model Context Protocol (MCP), enabling AI assistants and other MCP clients to securely manage secrets, encryption, and key rotation.

Adapters

HashiCorp Vault (11 tools)

Enterprise secrets management:

• vault_status - Check Vault server status

• vault_read - Read secrets from path

• vault_write - Write secrets to path

• vault_delete - Delete secrets

• vault_list - List secrets at path

• vault_token_lookup - Look up current token info

• vault_secrets_enable - Enable secrets engine

• vault_secrets_list - List enabled secrets engines

• vault_auth_list - List auth methods

• vault_policy_list - List policies

• vault_policy_read - Read policy details

Mozilla SOPS (7 tools)

File-based secrets encryption:

• sops_decrypt - Decrypt a file

• sops_encrypt - Encrypt a file

• sops_set - Set a value in encrypted file

• sops_rotate - Rotate data encryption keys

• sops_metadata - Show file metadata

• sops_updatekeys - Update keys in file

• sops_version - Show SOPS version

Requirements

• Deno runtime

• HashiCorp Vault CLI (for Vault tools)

• SOPS CLI (for SOPS tools)

Configuration

Vault

export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=your-token

SOPS

Configure .sops.yaml in your project root for encryption keys (age, AWS KMS, GCP KMS, Azure Key Vault, or PGP).

Installation

git clone https://github.com/hyperpolymath/poly-secret-mcp
cd poly-secret-mcp
npm install
npm run build

Usage

Run as MCP server:

deno run --allow-run --allow-read --allow-env main.js

Or use the systemd service:

systemctl --user enable poly-secret-mcp
systemctl --user start poly-secret-mcp

Security Considerations

• Never log or expose secret values in error messages

• Use short-lived tokens when possible

• Audit all secrets access

• Rotate keys regularly

License

MIT