secrets_manager.py is a Python utility that enables MCP servers to securely store and retrieve sensitive information using the system's native keychain/credential manager instead of relying on .env files. This approach significantly improves security by leveraging the operating system's built-in secure storage mechanisms.
- Cross-Platform Support: Works on macOS (Keychain), Windows (Credential Locker), and other platforms (using appropriate keyring backends)
- Secure Storage: Stores sensitive data like API keys in the system's secure credential storage
- Simple API: Provides straightforward functions for storing and retrieving secrets
- Command-Line Interface: Includes a CLI for managing secrets directly
The script uses the keyring library to store secrets in the system's native credential manager:
- On macOS: Stores secrets in the macOS Keychain
- On Windows: Uses the Windows Credential Locker
- On other platforms: Uses the best available keyring backend
get_secret(service_name, secret_key): Retrieves a secret from the system keyringset_secret(service_name, secret_key, secret_value): Stores a secret in the system keyringsetup_secrets(): Interactive function to collect and store initial secretstest_get_secret(): Tests the retrieval of stored secretsget_keyring_name(): Returns the name of the current keyring backend based on the platform
The script can be run directly with the following options:
--store: Initiates the interactive secret storage process--test: Tests retrieving stored secrets--info: Displays information about the current keyring backend
Instead of storing API keys in .env files:
# Old approach with .env files
API_KEY = os.getenv("API_KEY") # Insecure, stored in plaintext
# New approach with secrets_manager
from secrets_manager import get_secret
API_KEY = get_secret("MyMCPServer", "api_key") # Secure, stored in system keychain- Enhanced Security: Secrets are stored in the operating system's secure storage rather than in plaintext files
- Simplified Management: No need to manage
.envfiles or worry about them being accidentally committed to version control - User-Friendly: Provides an interactive interface for setting up secrets
- Reliable Access: Consistent API for accessing secrets across different platforms
The script includes a commented example of how to access the stored secret directly from the macOS terminal:
security find-generic-password -l "MyMCPServer" -a "api_key" -g