Summary
Minimal exposure by default, tokens only on request.
Listing returns ids and app names; the access token comes back only from get_credential_details, so the model does not carry secrets it has no use for. Write access stays off until an environment variable is changed, which makes a destructive call a configuration decision rather than an accident.
What it is
A local credential store exposed over MCP. Credentials live in ~/.credential-manager-mcp/credentials.json, and the server is read-only by default: the write tools work only once you turn them on.
What you get
- Stored credentials listed with the id and app name, and the username only when several entries share an app (list_credentials)
- One credential returned in full, access token included, when a call actually needs it (get_credential_details)
- Credentials added, updated and deleted once write mode is on (add_credential, update_credential, delete_credential)
- Read-only by default: CREDENTIAL_MANAGER_READ_ONLY has to be set to false before anything can change
- Fresh reads from disk on every call, so several clients can share one store
- A shell script for adding credentials outside the agent, interactively or from the command line
Requirements
A recent Python and uvx, then uvx credential-manager-mcp. Set CREDENTIAL_MANAGER_READ_ONLY to false if you want the write tools.
Setup effort
One command — uvx credential-manager-mcp