Credential storage and permissions
A toolkit records which keys a tool needs. Key values are stored on the computer using them, separately from the toolkit definition. To give a server its keys, follow Set up MCP credentials.
Where keys are stored
Section titled “Where keys are stored”The included Managed store uses the operating system’s credential store when available. Otherwise, it uses a local file protected by owner-only permissions and an integrity check. The file fallback is not encrypted. The storage method is recorded when the value is written.
To keep a value in the operating system’s keychain instead, add --provider os-keychain --instance os-keychain-local to csc key set.
Each computer has its own values. Connecting a computer does not copy them from another one. A value pasted into a coding-agent chat also remains in that chat transcript; local storage does not remove that copy.
One value, every toolkit
Section titled “One value, every toolkit”One credential holds one value for the whole workspace, so giving a server its key covers every toolkit that uses that same credential. csc key set lists the other toolkits the value reaches.
Give a value
Section titled “Give a value”csc key set reads one JSON object on standard input, keyed by setting name. Each entry is the value itself, or where to find it:
| Entry | Where the value comes from |
|---|---|
{ "env": "NAME" } |
A named environment variable. |
{ "command": "COMMAND" } |
What a credential helper prints. |
{ "file": "path" } |
The whole file. |
{ "file": "path", "name": "NAME" } |
One variable of a .env file. |
Run at a terminal with nothing piped in, it asks for each missing value with a hidden prompt.
Do not put key values in command-line arguments, examples, logs, or support messages. No key command prints a stored value back.
Check or remove a value
Section titled “Check or remove a value”csc key get --toolkit <toolkit-id> shows each key as ready, needing a value, or kept somewhere this computer cannot reach right now. csc key delete --toolkit <toolkit-id> --server <server> --setting <name> removes a value from this computer.
Removing a value is different from deleting a toolkit: it takes the value away from every toolkit that uses that credential, and leaves the toolkits themselves alone.
Command-line reference lists available management commands and their options.