Credential Manager

This Credential Manager MCP Server provides a secure, read‑only-by-default store for API credentials that you can access locally via an MCP client. It uses simple JSON storage and can be run in a few straightforward ways, making it easy to manage credentials in development or lightweight production setups.

How to use

You interact with the Credential Manager MCP Server through an MCP client. By default, the server operates in read‑only mode to prevent accidental changes. To perform write operations, you need to enable write access via the configured environment variable. The server stores credentials in your home directory at ~/.credential-manager-mcp/credentials.json and exposes minimal, essential data in listings.

Common tasks include listing credentials to see what you have stored and retrieving full details for a specific credential. When you write new credentials, you provide the application name, base URL, access token, and optional user name and expiration date. Use a read‑only workflow for inspection and a read‑write workflow for creating, updating, or deleting credentials.

To switch to write mode, set the environment variable CREDENTIAL_MANAGER_READ_ONLY to false when starting the server. All write operations respect this flag and will fail if write mode is not enabled.

How to install

Prerequisites you need before installing:

• Python-enabled environment (Python is commonly available from https://www.python.org/downloads/)
• A working MCP runtime you plan to use (examples include the MCP runner commands shown below)

Step 1: Install the MCP server from the package repository
- Run the install command to install the MCP server component:
  `uvx credential-manager-mcp

Step 2: Configure how you run the MCP server
- For a typical client setting, use the common configuration:
```json
{
  "mcpServers": {
    "credential-manager": {
      "command": "uvx",
      "args": ["credential-manager-mcp"],
      "env": {
        "CREDENTIAL_MANAGER_READ_ONLY": "false"
      }
    }
  }
}

• This enables the server in a write‑able mode when you need to add credentials.

Step 3: Development/run-from-source configuration

• If you are running from source during development, use:

{
  "mcpServers": {
    "credential-manager": {
      "command": "uv",
      "args": [
        "--directory", "/path/to/credential-manager-mcp",
        "run", "credential-manager-mcp"
      ],
      "env": {
        "CREDENTIAL_MANAGER_READ_ONLY": "false"
      }
    }
  }
}

• Update /path/to/credential-manager-mcp to the actual path where you have the source checked out.

## Additional configuration and usage notes

Environment variables you may use:
- `CREDENTIAL_MANAGER_READ_ONLY` — Set to `"false"` to enable write operations (default: `"true"`). This controls read/write access for the MCP server.

Credential expiration format:
- `"YYYY-MM-DDTHH:MM:SS"` ISO datetime
- `"never"` means the credential does not expire

Credentials are stored locally at `~/.credential-manager-mcp/credentials.json` with file locking to ensure safe concurrent access and minimal data exposure in listings.

## Security

- Read‑only by default to minimize accidental changes
- Local storage only at `~/.credential-manager-mcp/credentials.json`
- File locking ensures safe concurrent access
- Listings show only essential data to reduce exposure of sensitive information

## Development

git clone https://github.com/mclamee/credential-manager-mcp.git cd credential-manager-mcp uv sync --dev uv run pytest test/ -v

## License

MIT License - see LICENSE file for details.

## Available tools

### list\_credentials

List credentials (id, app name only) in read-only mode

### get\_credential\_details

Get full details for a specific credential in read-only mode

### add\_credential

Add a new credential with app, base\_url, access\_token, and optional user\_name and expires (write mode only)

### update\_credential

Update fields of an existing credential (write mode only)

### delete\_credential

Delete a credential by its id (write mode only)