Secrets Manager for MCP Server

Overview

secrets_manager.py is a Python utility that enables MCP servers to securely store and retrieve sensitive information using the system's native keychain/credential manager instead of relying on .env files. This approach significantly improves security by leveraging the operating system's built-in secure storage mechanisms.

Key Features

• Cross-Platform Support: Works on macOS (Keychain), Windows (Credential Locker), and other platforms (using appropriate keyring backends)
• Secure Storage: Stores sensitive data like API keys in the system's secure credential storage
• Simple API: Provides straightforward functions for storing and retrieving secrets
• Command-Line Interface: Includes a CLI for managing secrets directly

Core Functionality

Secret Storage

The script uses the keyring library to store secrets in the system's native credential manager:

• On macOS: Stores secrets in the macOS Keychain
• On Windows: Uses the Windows Credential Locker
• On other platforms: Uses the best available keyring backend

Main Functions

1. **get_secret(service_name, secret_key)**: Retrieves a secret from the system keyring

2. **set_secret(service_name, secret_key, secret_value)**: Stores a secret in the system keyring

3. **setup_secrets()**: Interactive function to collect and store initial secrets

4. **test_get_secret()**: Tests the retrieval of stored secrets

5. **get_keyring_name()**: Returns the name of the current keyring backend based on the platform

Command-Line Interface

The script can be run directly with the following options:

• --store: Initiates the interactive secret storage process
• --test: Tests retrieving stored secrets
• --info: Displays information about the current keyring backend

Usage Example

Instead of storing API keys in .env files:

# Old approach with .env files
API_KEY = os.getenv("API_KEY")  # Insecure, stored in plaintext

# New approach with secrets_manager
from secrets_manager import get_secret
API_KEY = get_secret("MyMCPServer", "api_key")  # Secure, stored in system keychain

Benefits for MCP Servers

1. Enhanced Security: Secrets are stored in the operating system's secure storage rather than in plaintext files

2. Simplified Management: No need to manage .env files or worry about them being accidentally committed to version control

3. User-Friendly: Provides an interactive interface for setting up secrets

4. Reliable Access: Consistent API for accessing secrets across different platforms

Implementation Note

The script includes a commented example of how to access the stored secret directly from the macOS terminal:

security find-generic-password -l "MyMCPServer" -a "api_key" -g