Keep MCP server secrets out of config files
Most MCP servers get their tokens from environment variables, so the usual setup writes the token straight into the client's JSON config. That file sits in your home folder or project, where agents, sync tools and backups can read it.
The usual way, with the token in the file
{ "mcpServers": { "github": {
"command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"],
"env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_…" } } } }
The LLLanyard way
Store the token in the keychain and approve the server once, by name:
lllanyard add github lllanyard tool add github-mcp --env GITHUB_PERSONAL_ACCESS_TOKEN=github \ --allow-host api.github.com --allow-host registry.npmjs.org --kill-on-leak \ -- npx -y @modelcontextprotocol/server-github
The config file then names the tool and holds no secret:
{ "mcpServers": { "github": { "command": "lllanyard", "args": ["run", "github-mcp"] } } }
Why approve the tool instead of just referencing the key?
If the config could say "run any command with this key", anything that can edit the file could point it at a command that sends the key away. Approved tools are stored in the keychain with the command pinned to its full path, so editing the config can't change what receives the key.
Guard rails while it runs
- The server gets a minimal environment, so it can't see your other keys or cloud credentials.
- Its output is scrubbed of the key, including base64, hex and URL-encoded copies.
--kill-on-leakstops it the first time it prints the key. --allow-hostlimits where it can connect. With--sandbox, that's enforced by the OS on Linux and macOS: no other network, an empty home folder, and only the project writable.
Give each server the narrowest token you can, such as a read-only GitHub token, as it still holds its own key while it runs.
Try it: LLLanyard is free for up to 10 keys.
npm install -g @lllanyard/cli lllanyard doctor