Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    mcp secrets lockdown

    1

    Find and migrate plain-text MCP secrets to secure environment variables across Claude Code, Cursor, and VS Code.

    $5

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    mcp secrets lockdown

    mcp secrets lockdown

    Example session with this skill installed

    I think I have API keys in my Claude Code and Cursor configs. Can you help me move them to a safe place and set up environment variables?

    • Read your context and instructions
    • Compiled the mcp secrets lockdown
    • Generated the document

    I have scanned your project and user directories. I found plain-text secrets in three MCP configuration files. Two of these are in files tracked by git, meaning those keys should be rotated after we finish this lockdown.

    MCP Secret Scan Results

    ToolFileServerTypeStatus
    Claude Code.mcp.jsonbrave-searchAPI_KEYFIXABLE (Git Tracked)
    Cursor.vscode/mcp.jsongithub-mcpAUTH_TOKENFIXABLE (Git Tracked)
    VS Codesettings.jsonpostgres-dbPASSWORDFIXABLE

    I have prepared a plan to move these to ~/.mcp-secrets.env and replace the values with ${VAR} and ${env:VAR} references.

    Action Taken:

    1. Created a plan.html report showing exactly which lines will be changed.
    2. Identified that BRAVE_API_KEY and GITHUB_TOKEN are in git history and require rotation.
    3. Verified the syntax for Cursor (${env:VAR}) vs Claude Code (${VAR}) to ensure compatibility.

    Next steps

    1. Run node scripts/lockdown.mjs apply to migrate the secrets and update configs.
    2. Add set -a; . ~/.mcp-secrets.env; set +a to your ~/.zshrc or ~/.bashrc.
    3. Delete the temporary backup folder at ~/.mcp-secrets-lockdown-backups/ once you verify the servers connect.

    plan.html

    PDF · document

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Hardcoded API keys and tokens in MCP configurations are a security failure waiting to happen. If you use Claude Code, Cursor, VS Code, or Gemini CLI, your mcp.json or settings.json likely contains plain-text secrets that could be leaked to git history or shared accidentally. This skill automates the discovery, extraction, and replacement of these secrets with secure environment variables.

    What it does

    • Secret Discovery scans project and user-level MCP configs for API keys, tokens, and passwords.
    • Automated Extraction moves plain-text values into a single, private .env file stored outside your repositories.
    • Smart Rewriting replaces hardcoded values with tool-specific syntax like ${VAR} or ${env:VAR} without breaking the server connection.
    • Git Leak Detection identifies if a secret was already committed to git, flagging it for mandatory rotation.
    • Validation verifies that all referenced variables are correctly defined and accessible to your agents.

    How it works

    1. Plan runs a read-only scan to show a table of findings, masked values, and the proposed variable names.
    2. Apply backs up existing configs, writes the private secrets file, and rewrites the original JSON/TOML files.
    3. Configure guides you through updating your shell profile or system environment variables so agents can read the new references.
    4. Verify runs a final check to ensure no plain-text secrets remain and all MCP servers still connect.

    Frameworks & tools

    Works with Node.js 18+ on Windows, macOS, and Linux. Supports configuration formats for Claude Code, Cursor, VS Code, Codex CLI, and Gemini CLI, including JSON, .mcp.json, and config.toml.

    Why this beats prompting it yourself

    Manual migration of MCP secrets is error-prone because every tool uses different environment variable syntax. This skill handles the specific escaping and formatting rules for multiple CLI tools simultaneously while ensuring you don't accidentally print a secret to your chat logs.

    Use cases

    • Repository Sanitization before pushing an MCP-enabled project to a public GitHub repo.
    • Team Collaboration allowing developers to share mcp.json files without sharing personal API keys.
    • Post-Leak Cleanup identifying which keys were compromised after an accidental commit to history.

    Known limitations

    Requires Node.js 18 installed on the host. GUI applications like Cursor or VS Code may require a full restart or launch from a terminal to pick up new environment variables.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 3 days ago

    • Passed all security checks, Safe to install

    Listed3 days ago

    What's inside

    Frequently Asked Questions