MCP Servers

= poly-secret-mcp :toc: :toc-placement!:

image:https://img.shields.io/badge/RSR-compliant-gold[RSR Compliant,link=https://github.com/hyperpolymath/rhodium-standard-repositories] image:https://img.shields.io/badge/MCP-server-blue[MCP Server,link=https://github.com/modelcontextprotocol] image:https://img.shields.io/badge/license-MIT-green[License]

Unified MCP server for secrets management. Provides Model Context Protocol tools for managing secrets through HashiCorp Vault and Mozilla SOPS.

toc::[]

== Overview

poly-secret-mcp exposes secrets management capabilities through the Model Context Protocol (MCP), enabling AI assistants and other MCP clients to securely manage secrets, encryption, and key rotation.

== Adapters

=== HashiCorp Vault (11 tools) Enterprise secrets management:

• vault_status - Check Vault server status
• vault_read - Read secrets from path
• vault_write - Write secrets to path
• vault_delete - Delete secrets
• vault_list - List secrets at path
• vault_token_lookup - Look up current token info
• vault_secrets_enable - Enable secrets engine
• vault_secrets_list - List enabled secrets engines
• vault_auth_list - List auth methods
• vault_policy_list - List policies
• vault_policy_read - Read policy details

=== Mozilla SOPS (7 tools) File-based secrets encryption:

• sops_decrypt - Decrypt a file
• sops_encrypt - Encrypt a file
• sops_set - Set a value in encrypted file
• sops_rotate - Rotate data encryption keys
• sops_metadata - Show file metadata
• sops_updatekeys - Update keys in file
• sops_version - Show SOPS version

== Requirements

• https://deno.land/[Deno] runtime
• https://www.vaultproject.io/[HashiCorp Vault] CLI (for Vault tools)
• https://github.com/getsops/sops[SOPS] CLI (for SOPS tools)

== Configuration

=== Vault

[source,bash]

export VAULT_ADDR=http://127.0.0.1:8200 export VAULT_TOKEN=your-token

=== SOPS

Configure .sops.yaml in your project root for encryption keys (age, AWS KMS, GCP KMS, Azure Key Vault, or PGP).

== Installation

[source,bash]

git clone https://github.com/hyperpolymath/poly-secret-mcp cd poly-secret-mcp npm install npm run build

== Usage

Run as MCP server:

[source,bash]

deno run --allow-run --allow-read --allow-env main.js

Or use the systemd service:

[source,bash]

systemctl --user enable poly-secret-mcp systemctl --user start poly-secret-mcp

== Security Considerations

• Never log or expose secret values in error messages
• Use short-lived tokens when possible
• Audit all secrets access
• Rotate keys regularly

== License

MIT