stacklok / toolhive / 18312986310

51%

push

github

Add secrets management support to ToolHive MCP server (#2006)

* Add secrets management support to ToolHive MCP server

Implement comprehensive secrets management functionality for the ToolHive MCP server:

- Add list_secrets tool to list available secrets from ToolHive secrets store
- Add set_secret tool to set secrets from file paths (file-based input only)
- Enhance run_server tool with secrets parameter support
- Add SecretMapping struct for structured secret name/target specification
- Include comprehensive test coverage for all new functionality
- Integrate with existing ToolHive secrets providers (encrypted, 1Password, etc.)

The run_server tool now accepts a secrets array parameter allowing users to
pass secrets to MCP servers when running them, matching the CLI --secret flag
functionality but through the MCP interface.

* Add documentation for secrets management design decisions

Clarify the following aspects of the secrets management implementation:
- Description field in SecretInfo is populated by providers that support
  it (e.g., 1Password provides "Vault :: Item :: Field" format) and
  remains empty for providers without description support
- SecretMapping intentionally excludes Description field as it's only
  relevant for listing/discovery, not for runtime secret mapping
- ListSecrets request parameter follows MCP tool handler interface
  requirements but is unused since list_secrets takes no arguments

Addresses review feedback from @yrobla on PR #2006.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

107 of 163 new or added lines in 5 files covered. (65.64%)

16860 of 36719 relevant lines covered (45.92%)

16.33 hits per line