Securecode MCP Server

Secrets vault for Claude Code with audit logs, access rules, and AES-256 encryption.

Local serverstdioTypeScript

What is the Securecode MCP server?

Most developer tooling work still happens through a UI a human drives. Securecode MCP server moves it into the conversation instead. Secrets vault for Claude Code with audit logs, access rules, and AES-256 encryption.

The short version

MCP Server for SecureCodeHQ. Lets Claude Code access your secrets securely without ever seeing them.

The tools it exposes

The server publishes 14 tools. What each one is for:

  • onboard — Guided setup: signup, import, API key, config, SDK
  • get-secret — Get a secret (injected to file by default, reveal: true to show to AI)
  • list-secrets — List all secrets with tags and expiry status
  • create-secret — Create a new secret
  • update-secret — Update value, description, or tags
  • delete-secret — Delete a secret
  • renew-secret — Renew expired secrets or change TTL
  • import-env — Import .env via secure web window (values never pass through AI)
  • export-env — Export secrets as .env or CSV
  • get-status — Check plan, usage, and MCP server version
  • wake-session — Unlock session with optional scope and auto-sleep timer
  • sleep-session — Lock session and clean injected files

What it needs from you

  • Node.js >= 18 - A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)

Getting it running

@securecode/mcp-server on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

How it compares

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Securecode's toolset — onboard, get-secret, list-secrets and 11 more — is a fair guide to whether it matches your workflow. It is maintained by juanisidoro; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Things to watch

  • It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
  • With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Securecode.
  • Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

Available tools

ToolWhat it does
onboardGuided setup: signup, import, API key, config, SDK
get-secretGet a secret (injected to file by default, reveal: true to show to AI)
list-secretsList all secrets with tags and expiry status
create-secretCreate a new secret
update-secretUpdate value, description, or tags
delete-secretDelete a secret
renew-secretRenew expired secrets or change TTL
import-envImport .env via secure web window (values never pass through AI)
export-envExport secrets as .env or CSV
get-statusCheck plan, usage, and MCP server version
wake-sessionUnlock session with optional scope and auto-sleep timer
sleep-sessionLock session and clean injected files
session-statusCheck session state and time remaining
byebyeLock session + clean all secrets from disk

How to install the Securecode MCP server

{
  "mcpServers": {
    "securecode": {
      "command": "npx",
      "args": ["-y", "@securecode/mcp-server"]
    }
  }
}

Add to claude_desktop_config.json, then restart Claude Desktop.

Configuration

  • Node.js >= 18 - A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)

Example prompts to try

  • Use Securecode to onboard.
  • Use Securecode to get-secret.
  • Use Securecode to list-secrets.

Frequently asked questions

It connects Securecode to MCP-compatible AI assistants such as Claude and Cursor, exposing 14 tools (onboard, get-secret, list-secrets, and more) that the assistant can call on your behalf. Instead of copying data back and forth by hand, the assistant works with Securecode directly.