Securecode MCP server

by juanisidoro·io.github.juanisidoro/securecode·v0.15.2·1 stars

No reviews yet

Secrets vault for Claude Code with audit logs, access rules, and AES-256 encryption.

B75/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B75/100

full report

Adoption

New

1 stars54 downloads/wk

Reviews

Write one

Nobody has reviewed Securecode yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Securecode tools (17, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

byebye
End your work session. Locks the session, cleans up all injected secrets from disk, and says goodbye. Use this when you finish working for the day.
create-secretwrite action
Create a new secret. Secrets with the same name can coexist if they have different env tags.
delete-secretwrite action
Delete a secret (soft delete, can be recovered)
export-env
Export all secrets as .env or CSV format. Returns the full content with decrypted values.
get-active-rules
List active MCP access rules. Read-only \u2014 rules can only be created or modified from the dashboard. Use this to understand why access to a secret was blocked.
get-secret
Get a secret by name. By default, injects the value into a local file so it never appears in the AI conversation. Use reveal:true to see the raw value (audited as conscious action). Use cleanup:true to remove all injected secrets from disk.
get-status
Get your SecureCodeHQ account status: plan, usage limits, secrets count, and MCP server version. Useful to check remaining capacity and verify the server is up to date.
help
Get SecureCode documentation: available tools, usage patterns, SDK setup, and common workflows. Use this to understand how to help the user with SecureCode.
import-env
Import secrets from .env files into SecureCode. For security, .env import must be done through the web interface \u2014 the AI agent never sees secret values during import. This tool provides the link to the import page.
list-secrets
List all available secrets with their tags and expiration status. Returns names and metadata, never values.
onboard
Start or continue the SecureCode onboarding. Guides the user through signup, .env import, API key creation, MCP configuration, and optional SDK setup \u2014 all from Claude Code. Call this tool multiple times to progress through the steps.
renew-secret
Renew an expired secret or change its TTL. Use this to reactivate expired secrets or extend expiration.
security-check
Analyze the project for security issues after SecureCode setup. Returns a list of actions the agent MUST execute to protect secrets. Call this after SDK installation.
session-status
Check the current session status: active or sleeping, scope restrictions, and time remaining before auto-sleep.
sleep-session
Lock the session immediately. All secret access will be blocked until you wake it again. Use this when you finish working.
update-secretwrite action
Update an existing secret's value, description, tags, or domain. Only provided fields are changed.
wake-session
Wake (unlock) the session to start accessing secrets. Optionally restrict access to specific tag scope and set auto-sleep timer.

Public scan report

scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan2 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 194 days ago4/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Securecode compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 75/100; higher than 45% of 48,255 servers
Tools: 17; the typical server has 7
Tools that change things: 18%; typical: 0%. Fewer write tools means less an agent can break
GitHub stars: 1; more than 65% of 28,688 servers
Downloads a week: 54; more than 45% of 12,191 servers with a package

What its tools let an agent do: 13 read · 2 create · 1 change · 1 delete

Install Securecode in Claude Code, Cursor or VS Code

Runs npx -y @securecode/mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add securecode -- npx -y @securecode/mcp-server

Add to Cursor

What the publisher says

From the Securecode repository's README, as published. We do not edit it. Read it on GitHub

@securecode/mcp-server

MCP Server for SecureCodeHQ. Lets Claude Code access your secrets securely without ever seeing them.

Quick Start

claude mcp add securecode -- npx -y @securecode/mcp-server

Then tell Claude Code:

Set up SecureCode in this project

The onboard tool walks you through account creation, secret import, and configuration. Takes about 2 minutes.

What It Does

Your secrets (API keys, tokens, passwords) are encrypted with AES-256 and stored in SecureCode. Claude Code accesses them via MCP, but the actual values never appear in the chat.

When Claude reads a secret, the value is written to a local file on your machine. The AI gets the file path but never sees the raw value. This is inject mode, the default.

Tools

MCP Access Rules

Control how AI agents access your secrets with tag-based policies. Created from the dashboard, enforced server-side.

Session Lock

You: "Wake my session for acme staging"
Claude: Session unlocked. Only acme/staging secrets accessible.

You: "byebye"
Claude: Session locked & secrets cleaned from disk.

Sessions auto-sleep after configurable inactivity (default: 2 hours).

How It Works

Secret values are written to a local file, the AI never sees them (inject mode)
Explicit reveal: true returns value to AI (audited)
Injected files are removed on sleep, byebye, or process exit
Multiple Claude Code instances don't collide (hash based on API key + PID)
Encrypted with AES-256-GCM using envelope encryption (Cloud KMS)
Every access is logged with AI model, IP, machine identity, and timestamp
Runs locally via stdio transport, secrets never pass through third parties
Device approval required on first use from each machine

SDK

The companion SDK lets your app load secrets at runtime:

npm install @securecode/sdk

import { loadEnv } from '@securecode/sdk';
await loadEnv(); // all secrets loaded into process.env

SDK on npm

Requirements

Node.js >= 18
A SecureCodeHQ account (free tier: 50 secrets, 10K accesses/month)

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Securecode: common questions

Is Securecode MCP server safe?: Mostly: it is graded B (75/100). Read the Securecode safety report
How do I install Securecode?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Securecode need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Securecode maintained?: The last commit was 232 days ago (2026-03-17). The latest release is v0.15.2.
What can I use instead of Securecode?: Servers from other publishers that do the same job: SSH Manager MCP server.
How does Securecode compare with other MCP servers?: safety score 75/100 (higher than 45% of 48,255 servers); tools 17 (the typical server has 7); tools that change things 18% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Securecode

Same job from other publishers: the closest match first, then the best rated.

SSH Manager
SSH for AI agents: commands, files, backups and health, with approval, a vault and an audit trail
not reviewed
Established
A