# juanisidoro/securecode-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/juanisidoro/securecode-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 320  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/juanisidoro-securecode-mcp

## Description
Secrets vault for Claude Code with audit logs, MCP access rules, and AES-256 encryption. Secrets are injected to local files so the AI never sees raw values. Includes session lock, device approval, and per-model access policies.

## Tools
Capabilities this server exposes over MCP:

- **onboard** — Guided setup: signup, import, API key, config, SDK
- **get-secret** — Get a secret (injected to file by default, `reveal: true` to show to AI)
- **list-secrets** — List all secrets with tags and expiry status
- **create-secret** — Create a new secret
- **update-secret** — Update value, description, or tags
- **delete-secret** — Delete a secret
- **renew-secret** — Renew expired secrets or change TTL
- **import-env** — Import .env via secure web window (values never pass through AI)
- **export-env** — Export secrets as .env or CSV
- **get-status** — Check plan, usage, and MCP server version
- **wake-session** — Unlock session with optional scope and auto-sleep timer
- **sleep-session** — Lock session and clean injected files
- **session-status** — Check session state and time remaining
- **byebye** — Lock session + clean all secrets from disk
- **get-active-rules** — List active MCP access rules (read-only)
- **security-check** — Post-setup security hardening checks
- **help** — Docs: tools, SDK, sessions, rules, troubleshooting

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "securecode-mcp": {
    "command": "npx",
    "args": ["-y","@securecode/mcp-server"]
  }
}
```

## Documentation & README

# @securecode/mcp-server

MCP Server for [SecureCodeHQ](https://securecodehq.com). Lets Claude Code access your secrets securely without ever seeing them.

[![SecureCode MCP server](https://glama.ai/mcp/servers/juanisidoro/securecode-mcp/badges/card.svg)](https://glama.ai/mcp/servers/juanisidoro/securecode-mcp)

## Quick Start

```bash
claude mcp add securecode -- npx -y @securecode/mcp-server
```

Then tell Claude Code:

```
Set up SecureCode in this project
```

The onboard tool walks you through account creation, secret import, and configuration. Takes about 2 minutes.

## What It Does

Your secrets (API keys, tokens, passwords) are encrypted with AES-256 and stored in SecureCode. Claude Code accesses them via MCP, but the actual values never appear in the chat.

When Claude reads a secret, the value is written to a local file on your machine. The AI gets the file path but never sees the raw value. This is inject mode, the default.

## Tools

| Tool | What it does |
|------|-------------|
| `onboard` | Guided setup: signup, import, API key, config, SDK |
| `get-secret` | Get a secret (injected to file by default, `reveal: true` to show to AI) |
| `list-secrets` | List all secrets with tags and expiry status |
| `create-secret` | Create a new secret |
| `update-secret` | Update value, description, or tags |
| `delete-secret` | Delete a secret |
| `renew-secret` | Renew expired secrets or change TTL |
| `import-env` | Import .env via secure web window (values never pass through AI) |
| `export-env` | Export secrets as .env or CSV |
| `get-status` | Check plan, usage, and MCP server version |
| `wake-session` | Unlock session with optional scope and auto-sleep timer |
| `sleep-session` | Lock session and clean injected files |
| `session-status` | Check session state and time remaining |
| `byebye` | Lock session + clean all secrets from disk |
| `get-active-rules` | List active MCP access rules (read-only) |
| `security-check` | Post-setup security hardening checks |
| `help` | Docs: tools, SDK, sessions, rules, troubleshooting |

## MCP Access Rules

Control how AI agents access your secrets with tag-based policies. Created from the [dashboard](https://securecodehq.com), enforced server-side.

| Action | Effect |
|--------|--------|
| Block Always | Secret only accessible from the dashboard |
| Require Confirmation | Agent must acknowledge before accessing |
| Require Session | Requires active session (wake-session) |
| Block Models | Only allows specific AI models |
| Notify | Sends email on access (non-blocking) |

## Session Lock

```
You: "Wake my session for acme staging"
Claude: Session unlocked. Only acme/staging secrets accessible.

You: "byebye"
Claude: Session locked & secrets cleaned from disk.
```

Sessions auto-sleep after configurable inactivity (default: 2 hours).

## How It Works

- Secret values are written to a local file, the AI never sees them (inject mode)
- Explicit `reveal: true` returns value to AI (audited)
- Injected files are removed on sleep, byebye, or process exit
- Multiple Claude Code instances don't collide (hash based on API key + PID)
- Encrypted with AES-256-GCM using envelope encryption (Cloud KMS)
- Every access is logged with AI model, IP, machine identity, and timestamp
- Runs locally via stdio transport, secrets never pass through third parties
- Device approval required on first use from each machine

## SDK

The companion SDK lets your app load secrets at runtime:

```bash
npm install @securecode/sdk
```

```typescript
import { loadEnv } from '@securecode/sdk';
await loadEnv(); // all secrets loaded into process.env
```

[SDK on npm](https://www.npmjs.com/package/@securecode/sdk)

## Links

- Website: https://securecodehq.com
- npm: https://www.npmjs.com/package/@securecode/mcp-server
- SDK: https://www.npmjs.com/package/@securecode/sdk

## Requirements

- Node.js >= 18
- A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)

## License

MIT