MCP

The Model Context Protocol (MCP) enables AI agents to connect to external data sources and tools. When using MCP, you often need to handle sensitive configuration like API keys, database credentials, and authentication tokens. varlock provides a secure way to manage these secrets without exposing them in your configuration files or to AI agents.

This guide covers three scenarios:

Local MCP servers using stdio transport with varlock run
Remote MCP servers using varlock’s Node.js integration
Third-party MCP servers using varlock to load secrets and pass them to the server

Guides in this section

Local MCP servers (stdio): wrap stdio MCP servers with varlock run
Remote MCP servers: HTTP/SSE MCP with validated env
Docs MCP: search varlock documentation from your agent

Security Best Practices

1. Never Store Secrets in Plain Text

Always use external secret management such as 1Password or the built-in env var management in your deployment platform.

# ❌ Never do this
API_KEY=sk_live_1234567890abcdef

# ✅ Use external secret management
API_KEY=op(op://devTest/myVault/api-key)

2. Use Environment-Specific Schemas

Create separate schema files for different environments. See the environments guide for detailed information on managing multiple environments with varlock.

# @defaultSensitive=true
# @currentEnv=$APP_ENV
# ---

# env flag is used to determine which environment to load
# default is development
# @type=enum(development, staging, test, production)
APP_ENV=development

# Common configuration
DATABASE_URL=
API_KEY=

DATABASE_URL=postgresql://localhost:5432/dev_db
API_KEY=op(op://devTest/myVault/dev-api-key)

DATABASE_URL=op(op://prodTest/prodVault/prod-database-url)
API_KEY=op(op://prodTest/prodVault/prod-api-key)

3. Validate Sensitive Data

Use varlock’s validation features to ensure data integrity:

# @type=string(startsWith="sk_", minLength=20)
API_KEY=

# @type=url
DATABASE_URL=

4. Monitor and Log Securely

Use varlock’s redaction features to prevent sensitive data from appearing in logs:

import 'varlock/auto-load';
import { ENV } from 'varlock/env';

// Sensitive values are automatically redacted in logs
console.log('API Key:', ENV.API_KEY); // Shows: [xx▒▒▒▒▒]
console.log('Database URL:', ENV.DATABASE_URL); // Shows: [xx▒▒▒▒▒]

Next Steps

Learn more about varlock’s environment specification
Explore available data types for validation
Check out function reference for external integrations
Read about secrets management best practices