LABSCO SUMMARY
Their secrets model is strict: changing a package's code invalidates the installation.
Secrets live on a keychain and are exposed only to the specific secrets a tool asks for, only open-source tools may request secrets at all, and if the package code changes, the installation is void until you re-approve. That last rule closes the supply-chain hole that every tool registry has — a package you vetted quietly updating underneath you and inheriting the credentials you already granted. It costs convenience on every update, and it is the correct trade for anything holding a database password.
What it is
Superuser hosts tools rather than being one. Every package published there becomes its own server with its own address, so there is no single endpoint or global tool list.
What you get
Whatever you or someone else publishes, plus their first-party toolkits — Postgres, image generation, search through Exa and Perplexity, Wikipedia, weather and YouTube among the documented examples. Tools published there can be used outside Superuser too.
Requirements
An account and a secret token. Person-to-person chat is free; agents are a monthly subscription with per-token overage, and hosted tool execution is billed by compute time.
Setup effort
Follow the published steps
USE CASES
01
Publishing a tool for your agent
Each package becomes its own hosted server.
02
Using it elsewhere
Documented as usable outside Superuser, not locked to their client.
03
Giving a tool a credential
Keychain secrets, scoped to what the tool asked for, void on code change.
BEFORE YOU INSTALL
What to know first
Requires
A keychain secret token in the Authorization header — not an OAuth flow
INSTALLATION
Connect your client
Server setup
Open the package you want on https://superuser.app/toolkits — every package page comes with its own Servers section, and the MCP Server listed there is the URL for use in other products.
Create an API keychain at https://superuser.app/dashboard/api-keychains, then install that package to the keychain — a keychain works only with the packages installed to it.
Add the package's MCP Server URL to your client and send the keychain secret as a Bearer token in the Authorization header.
