@securecode/mcp-server

@securecode/mcp-server

MCP Server for SecureCodeHQ. Lets Claude Code access your secrets securely without exposing them in the chat.

Setup (2 minutes)

1. Get your API key from securecodehq.com > Settings > API Keys

2. Add to your Claude Code config:

Edit ~/.claude.json:

{
  "mcpServers": {
    "securecode": {
      "command": "npx",
      "args": ["@securecode/mcp-server"],
      "env": {
        "SECURECODE_API_KEY": "sc_your_key_here"
      }
    }
  }
}

3. Restart Claude Code. That's it.

What Claude Can Do

Once connected, Claude Code can:

"Get my Stripe API key"              -> reads from your vault
"List my production secrets"         -> shows names and tags, never values
"Save this API key as OPENAI_KEY"    -> creates a new secret
"Import my .env.production file"     -> bulk import with auto-tagging
"Lock my session"                    -> blocks all access until you wake it

Available Tools

Tool	Description
get-secret	Get a secret value by name (with environment disambiguation)
list-secrets	List all secrets with tags, expiry status, and descriptions
create-secret	Create a new secret with tags, TTL, and domain
update-secret	Update value, description, tags, or domain
delete-secret	Soft-delete a secret
renew-secret	Renew expired secrets or change TTL
import-env	Import from .env or CSV content (with preview mode)
export-env	Export secrets as .env or CSV format
get-status	Check plan, usage limits, and secrets count
wake-session	Unlock session with optional tag scope and auto-sleep timer
sleep-session	Lock session immediately, block all access
session-status	Check session status, scope, and time remaining

Security Tips (Tip Engine)

The MCP server includes an adaptive Tip Engine that educates developers about security best practices:

• First session: Welcome message with best practices (shown before first secret)
• Production access: Warning when accessing production-tagged secrets (shown before secret)
• Stale secrets: Reminder to rotate credentials older than 90 days
• Generic names: Suggestion to use descriptive secret names
• No TTL: Recommendation to set expiration on frequently-used secrets

Tips are throttled (max 3 per session, 1-week cooldown per secret) so they inform without annoying.

Session Lock

Control access to your secrets per session:

You: "Wake my session for the acme project staging"
Claude: [calls wake-session with scope [{project:"acme", env:"staging"}]]
       -> Session unlocked. Only acme/staging secrets accessible.

You: "Lock my session"
Claude: [calls sleep-session]
       -> Session locked. All access blocked.

Sessions auto-sleep after configurable inactivity (default: 2 hours).

How It Works

• Secrets are encrypted with AES-256-GCM using envelope encryption (Cloud KMS)
• Every access is logged with AI model, IP, machine identity, and timestamp
• API keys are scoped to your account with sc_ prefix
• The MCP server runs locally via stdio transport — secrets never pass through third parties
• Device approval required on first use from each machine

Requirements

• Node.js >= 18
• A SecureCodeHQ account with an API key

License

MIT