MCP Server

envpkt ships an MCP server that gives AI agents structured awareness of their credentials. The server reads envpkt.toml which contains metadata — never plaintext secret values.

Configuration

Add envpkt to your MCP client config:

{
  "mcpServers": {
    "envpkt": {
      "command": "envpkt",
      "args": ["mcp"]
    }
  }
}

Starting the Server

envpkt mcp

Uses stdio transport. The server reads envpkt.toml from the current directory (or specify with -c).

Tools

Tool	Description
getPacketHealth	Get overall health status with per-secret audit results
listCapabilities	List agent and per-secret capabilities
getSecretMeta	Get metadata for a specific secret by key
checkExpiration	Check expiration status and days remaining
getEnvMeta	Get metadata for environment defaults and drift status

getPacketHealth

Returns the full audit result including overall status and per-secret health.

listCapabilities

Returns agent-level capabilities (from [agent].capabilities) and per-secret capabilities (from each [secret.KEY].capabilities).

getSecretMeta

Takes a secret key and returns its metadata (service, purpose, capabilities, expiration, rotation URL, etc.).

checkExpiration

Returns expiration status for all secrets, including days remaining and expired flags.

getEnvMeta

Returns metadata for configured environment defaults ([env.*] entries) and their current drift status.

Resources

URI	Description
envpkt://health	Current credential health summary
envpkt://capabilities	Agent and secret capabilities

Security Model

The MCP server does not have access to secret values — this is an architectural constraint, not a policy choice:

• The server reads from envpkt.toml, which contains metadata but never plaintext secret values
• It never calls boot(), unsealSecrets(), or reads process.env for secret values
• Encrypted ciphertext (encrypted_value fields) is excluded from tool responses
• Only metadata is shared: service names, expiration dates, capabilities, rotation URLs

This means prompt injection attacks against the MCP layer cannot leak secret values — there are no secret values to leak. See the Security Model in the README for the full three-tier trust model.

Library API

import { createServer, startServer, toolDefinitions, callTool, resourceDefinitions, readResource } from "envpkt"

// Tool definitions for MCP registration
const tools = toolDefinitions

// Call a tool
const result = callTool("getPacketHealth", {}, config, audit)

// Resource definitions
const resources = resourceDefinitions

// Read a resource
const data = readResource("envpkt://health", config, audit)