Set up MCP credentials

An MCP server can give a coding app access to another service. Some servers need a credential, such as a service-issued key or token. Set that up on the computer where the server will run. You add it once, Code Config remembers which of your toolkit’s servers use it, and every launch writes it into the coding app’s own configuration for you.

Before you start

Add the server to your toolkit and connect this computer. Claude Code, Codex, opencode, Cursor, and Antigravity each keep MCP servers in their own configuration file, and a launch writes the one your coding app reads, with the credential already in it. For Cursor that file is .cursor/mcp.json in the project it opens. The coding-app guide covers what each app does with it.

Set up one server

Open the toolkit in the web app, choose Configuration, and find Tools needing setup. Copy the command for the server and run it on the destination computer. Its form is:

csc mcp setup --toolkit <toolkit-id> --server <mcp-id>

Use the command supplied by the app so the IDs are correct. Follow its local prompts. Binding a key to a server in a toolkit lets that server use it. Code Config asks for no separate approval. Prefer a hidden terminal prompt or an existing local credential source over pasting a value into an agent chat. Values entered in chat also become part of that transcript.

Repeat setup on each computer that needs the server. Connecting another computer does not transfer credential values to it.

Check it worked

Run the status command for the same toolkit:

csc mcp status --toolkit <toolkit-id>

Start a new launch with that toolkit, then check the server’s connection in the coding app. A saved credential binding wires the value in; the service still decides whether it accepts the credential.

If the server is not ready

Read the reason and run the setup command shown for that server. You may need to sync an updated toolkit or unlock the credential store.

A coding app can open while an MCP server remains unconfigured. Other toolkit content may still work; complete the named setup before relying on the server.

For example, a server can report binding-missing, which means the credential has not been set up on this computer.

Troubleshooting lists the reasons and actions.

Put a key in a slot from the web app

Every tool in a toolkit that asks for a key shows that slot under Configuration → Tools needing setup, with the key currently in it. Each slot has its own controls:

Choose a key or Use a different key offers the keys you already hold that fit that slot. A slot that takes a token is not offered a database connection string.
New key reserves a name for a key you have not added yet. The name starts as the tool and the slot it fills, and you can change it to anything you like. You still paste the key itself on the computer you launch from, using the setup command on the same page.
Remove key empties the slot and leaves the key itself alone, still available for other slots.

Choosing a key another toolkit already uses tells you so before you commit, because both slots then share one key: change it later and both change together.

Where the value is stored

The default managed store uses the operating system’s credential store when available. Its file fallback uses owner-only permissions and an integrity check, not encryption. Storage is local to the computer.

Credential storage and permissions covers storage, scopes, and noninteractive input.