Set up MCP credentials

MCP servers are what let your agent work with other services: query your Supabase database, read a Figma file, or open issues on GitHub. Most of them need a key from that service before they work.

You add each key once, on the computer you launch from. Code Config remembers which of your toolkits’ servers use it, and every launch hands it to the coding app for you. Your keys stay on your computer; they’re never sent to Code Config.

For example, Plantpal’s build toolkit includes the Supabase MCP server. Until you give it your Supabase access token, the agent can’t see your database.

Before you start

Add the server to your toolkit and connect this computer. Claude and Codex each keep MCP servers in their own configuration, and a launch of the Claude app, Claude Code CLI, the Codex app, or Codex CLI sets up the servers your coding app reads, with the credential already in place. The coding-app guide covers what each app does with it.

Add a key for one server

Open the toolkit in the web app. On Contents, a server that needs a key is marked Setup required, and the Setup or action required filter shows only those. Open the server’s details, or choose Set up keys from its menu, to see the command that adds its key. Copy the command and run it on the computer you launch from. Its form is:

csc key set --toolkit <toolkit-id> --server <mcp-id>

Use the command supplied by the app so the IDs are correct. To have your coding agent do it instead, choose Copy assistant prompt in the same details and give the prompt to the agent. At a terminal it asks for each key with a hidden prompt. Giving a key to a server in a toolkit lets that server use it. Code Config asks for no separate approval. Prefer a hidden terminal prompt or an existing local credential source over pasting a value into an agent chat. Values entered in chat also become part of that transcript.

An agent or a script gives the command one JSON object on its standard input instead, keyed by setting name, where each entry is the value itself or where the value already is: { "env": "NAME" }, { "file": ".env", "name": "NAME" }, or { "command": "gh auth token" }.

A key that the coding app’s own settings in the toolkit need is set the same way, with --app claude or --app codex in place of --server <mcp-id>. Those keys, with their commands, are listed under Other keys this toolkit needs at the end of Contents.

In the Code Config app, Settings → Keys lists every key your toolkits need, and its paste field takes a .env file or a JSON object and saves each value to the setting with the same name.

Repeat setup on each computer that needs the server. Connecting another computer does not transfer credential values to it.

Check that the server is ready

Check the keys for the same toolkit:

csc key get --toolkit <toolkit-id>

Start a new launch with that toolkit, then check the server’s connection in the coding app. A saved key is written into the app’s settings; the service still decides whether it accepts the credential.

If the server is not ready

Read the reason and run the setup command shown for that server. You may need to sync an updated toolkit or unlock the credential store.

A coding app can open while an MCP server remains unconfigured. Other toolkit content may still work; complete the named setup before relying on the server.

For example, a key that reads needs_value has not been set up on this computer, and its row carries the command that sets it up.

Troubleshooting lists the reasons and actions.

Choose which key a tool uses

Every tool in a toolkit that asks for a key shows that slot in its details on the toolkit’s Contents, with the key currently in it. Each slot has its own controls:

• Choose a key or Use a different key offers the keys you already hold that fit that slot. A slot that takes a token is not offered a database connection string.
• New key reserves a name for a key you have not added yet. The name starts as the tool and the slot it fills, and you can change it to anything you like. You still paste the key itself on the computer you launch from, using the setup command in the same details.
• Remove key empties the slot and leaves the key itself alone, still available for other slots.

Choosing a key another toolkit already uses tells you so before you commit, because both slots then share one key: change it later and both change together.

Where your keys are kept

The default managed store uses the operating system’s credential store when available. Its file fallback uses owner-only permissions and an integrity check, not encryption. Storage is local to the computer.

Next

Credential storage and permissions covers storage, scopes, and noninteractive input.