mcpField
S
securecode

securecode

Local
github.com/juanisidoroSecurity1Updated 32w ago
Repository

About securecode

securecode is an MCP server for Claude Code to manage SecureCodeHQ secrets without exposing their raw values in chat. It combines file-based secret injection with access rules, session controls, and audit logs.

Key features

  1. 01Inject secrets into local files
  2. 02Create, update, import, and export secrets
  3. 03Apply tag-based access rules
  4. 04Lock and unlock scoped sessions
  5. 05Log secret access and run security checks

Use cases

  1. 01Give Claude Code access to API keys without showing values in chat
  2. 02Limit secret access by tags or active session
  3. 03Review secret access records and session status

MCP support

Claude Code connects to the local server over stdio. It exposes tools for secret management, session control, and access-rule inspection.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "juanisidoro-securecode": {
      "command": "npx",
      "args": [
        "-y",
        "@securecode/mcp-server"
      ]
    }
  }
}
Run commandnpx -y @securecode/mcp-server

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@securecode/mcp-server0.15.2

Tools

17

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
namestringNoThe exact name of the secret (e.g. STRIPE_SECRET_KEY)
tagsobjectNoFilter tags to disambiguate same-name secrets, e.g. { "env": "production", "project": "acme" }
revealbooleanNoIf true, returns the raw value in the conversation (audited as reveal). Default: false (inject mode — value written to local file, never shown)
cleanupbooleanNoIf true, removes all injected secret files from disk

Details

From the project README

@securecode/mcp-server

MCP Server for SecureCodeHQ. Lets Claude Code access your secrets securely without ever seeing them.

SecureCode MCP server

Quick Start

claude mcp add securecode -- npx -y @securecode/mcp-server

Then tell Claude Code:

Set up SecureCode in this project

The onboard tool walks you through account creation, secret import, and configuration. Takes about 2 minutes.

What It Does

Your secrets (API keys, tokens, passwords) are encrypted with AES-256 and stored in SecureCode. Claude Code accesses them via MCP, but the actual values never appear in the chat.

When Claude reads a secret, the value is written to a local file on your machine. The AI gets the file path but never sees the raw value. This is inject mode, the default.

Tools

ToolWhat it does
onboardGuided setup: signup, import, API key, config, SDK
get-secretGet a secret (injected to file by default, reveal: true to show to AI)
list-secretsList all secrets with tags and expiry status
create-secretCreate a new secret
update-secretUpdate value, description, or tags
delete-secretDelete a secret
renew-secretRenew expired secrets or change TTL
import-envImport .env via secure web window (values never pass through AI)
export-envExport secrets as .env or CSV
get-statusCheck plan, usage, and MCP server version
wake-sessionUnlock session with optional scope and auto-sleep timer
sleep-sessionLock session and clean injected files
session-statusCheck session state and time remaining
byebyeLock session + clean all secrets from disk
get-active-rulesList active MCP access rules (read-only)
security-checkPost-setup security hardening checks
helpDocs: tools, SDK, sessions, rules, troubleshooting

MCP Access Rules

Control how AI agents access your secrets with tag-based policies. Created from the dashboard, enforced server-side.

ActionEffect
Block AlwaysSecret only accessible from the dashboard
Require ConfirmationAgent must acknowledge before accessing
Require SessionRequires active session (wake-session)
Block ModelsOnly allows specific AI models
NotifySends email on access (non-blocking)

Session Lock

You: "Wake my session for acme staging"
Claude: Session unlocked. Only acme/staging secrets accessible.

You: "byebye"
Claude: Session locked & secrets cleaned from disk.

Sessions auto-sleep after configurable inactivity (default: 2 hours).

How It Works

  • Secret values are written to a local file, the AI never sees them (inject mode)
  • Explicit reveal: true returns value to AI (audited)
  • Injected files are removed on sleep, byebye, or process exit
  • Multiple Claude Code instances don't collide (hash based on API key + PID)
  • Encrypted with AES-256-GCM using envelope encryption (Cloud KMS)
  • Every access is logged with AI model, IP, machine identity, and timestamp
  • Runs locally via stdio transport, secrets never pass through third parties
  • Device approval required on first use from each machine

SDK

The companion SDK lets your app load secrets at runtime:

npm install @securecode/sdk

import { loadEnv } from '@securecode/sdk';
await loadEnv(); // all secrets loaded into process.env

SDK on npm

Links

Requirements

  • Node.js >= 18
  • A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.