4 ms·

What is your preferred way to manage them?

ivanvanderbyl 1y ago
1Password’s CLI op does a reasonably good job of this
devenjarvis 1y ago
The 1pass CLI is great! However if you aren’t using 1password as your secrets vault, I’m building an open source, vault-agnostic alternative called RunSecret (https://github.com/runsecret/rsec https://github.com/runsecret/rsec)
- mdaniel 1y ago
  You may want to do your own Show HN about it, so folks don't have to be "MCP curious" to find out that it exists That said, given https://github.com/runsecret/rsec#aws-secrets-manager https://github.com/runsecret/rsec#aws-secrets-manager presumably in order to keep AWS credentials off disk one would then have to have this? "vantage-mcp-server": { "command": "/opt/homebrew/bin/aws-vault", "args": [ "exec", "--region=us-east-1", "my-awesome-profile", "--", "/opt/homebrew/bin/rsec", "run", "--", "/opt/homebrew/bin/vantage-mcp-server" ], "env": {"VANTAGE_BEARER_TOKEN": "rsec://012345678912/sm.aws/VantageBearerToken?region=us-east-1"} } in contrast to the op binary that is just one level of indirection, since they already handshake with the desktop app for $(op login) purposes
  - devenjarvis 1y ago
    This is great feedback, thank you! I agree RunSecret adds a level of indirection at this stage that op doesn’t (if you are using 1pass). This is something I plan to polish up once more vaults are supported. You’ve given me some ideas on how to do that here. And thanks for the advice on doing a Show HN, planning to do so once a few more rough edges are smoothed out.
nel-vantage 1y ago
Vantage engineer who worked on this feature here. The security posture of MCP servers is still in its early stages (see “The ‘S’ in MCP Stands for Security” from three weeks ago [https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands-for-security-91407b33ed6b https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands...]). The recommendations above to use something like the 1Password CLI wrapper when invoking an MCP server seem sound. That being said, an easier-to-distribute user experience would be to leverage short-lived OAuth tokens that LLM clients such as Claude or Goose ultimately manage for the user. We’re exploring these avenues as we develop the server.
klooney 1y ago
If your service is running in AWS, use the native IAM identity loading from ECS, EKS, EC2, etc. If it's your laptop, set AWS_PROFILE and let the SDK load the temporary creds from ~/.aws. If you really really really need to use static creds on your laptop, use aws-vault to export them, or ephemeral creds generated from them, into your environment.

1Password’s CLI op does a reasonably good job of this

The 1pass CLI is great! However if you aren’t using 1password as your secrets vault, I’m building an open source, vault-agnostic alternative called RunSecret (https://github.com/runsecret/rsec https://github.com/runsecret/rsec)

mdaniel 1y ago
You may want to do your own Show HN about it, so folks don't have to be "MCP curious" to find out that it exists That said, given https://github.com/runsecret/rsec#aws-secrets-manager https://github.com/runsecret/rsec#aws-secrets-manager presumably in order to keep AWS credentials off disk one would then have to have this? "vantage-mcp-server": { "command": "/opt/homebrew/bin/aws-vault", "args": [ "exec", "--region=us-east-1", "my-awesome-profile", "--", "/opt/homebrew/bin/rsec", "run", "--", "/opt/homebrew/bin/vantage-mcp-server" ], "env": {"VANTAGE_BEARER_TOKEN": "rsec://012345678912/sm.aws/VantageBearerToken?region=us-east-1"} } in contrast to the op binary that is just one level of indirection, since they already handshake with the desktop app for $(op login) purposes
- devenjarvis 1y ago
  This is great feedback, thank you! I agree RunSecret adds a level of indirection at this stage that op doesn’t (if you are using 1pass). This is something I plan to polish up once more vaults are supported. You’ve given me some ideas on how to do that here. And thanks for the advice on doing a Show HN, planning to do so once a few more rough edges are smoothed out.

nel-vantage 1y ago

Vantage engineer who worked on this feature here. The security posture of MCP servers is still in its early stages (see “The ‘S’ in MCP Stands for Security” from three weeks ago [https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands-for-security-91407b33ed6b https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands...]). The recommendations above to use something like the 1Password CLI wrapper when invoking an MCP server seem sound. That being said, an easier-to-distribute user experience would be to leverage short-lived OAuth tokens that LLM clients such as Claude or Goose ultimately manage for the user. We’re exploring these avenues as we develop the server.

klooney 1y ago

If your service is running in AWS, use the native IAM identity loading from ECS, EKS, EC2, etc. If it's your laptop, set AWS_PROFILE and let the SDK load the temporary creds from ~/.aws. If you really really really need to use static creds on your laptop, use aws-vault to export them, or ephemeral creds generated from them, into your environment.