wrap-mcp

What problem does it solve?

It prevents sensitive MCP credentials (tokens, API keys, passwords, client secrets) from being stored in MCP JSON/YAML configuration files by forcing all secrets to live in a secure secret store and only exposing them at runtime through a wrapper.

Core Features & Use Cases

• Pass-backed secret retrieval: Store credentials in pass and fetch them on-demand for the MCP server process.
• Wrapper-only MCP configuration: Point the MCP command to a local wrapper script so the config never contains secret env vars, header values, or token arguments.
• Safer token rotation flow: Update stored tokens in pass without editing MCP configs, using a mcp-update-token workflow.
• Pinentry-aware unlocking: Use curses pinentry and gpg-agent caching so decryption happens interactively when needed, not during chat or static config writing.
• Wrapper rename/move synchronization: Keep an explicit comment list inside the wrapper so related MCP config paths stay consistent when the wrapper changes.

Quick Start

Create a mcp-<server> wrapper that pulls the token from pass and update your Cursor/Claude/Hermes MCP configuration so its command points only to that wrapper.