Agentic Security & Safety

How do you securely store credentials for custom MCP servers?

Last verified: July 2026 · 2 min read
QUICK ANSWER

Store credentials for custom MCP servers in system environment variables or secure credential managers (e.g. AWS Secrets Manager, Vault, or local Keychain) and retrieve them dynamically at runtime instead of hardcoding tokens inside the Claude Desktop config.json file.

Secure Configuration Example

Avoid placing plaintext passwords or API keys in your shared claude_desktop_config.json. Instead, reference environment variables:

{
  "mcpServers": {
    "secure-database": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": {
        "PGPASSWORD": "$DB_PASSWORD_ENV"
      }
    }
  }
}

Runtime Secret Resolution

If building a custom server in TypeScript/Python, retrieve secrets dynamically at startup rather than saving them in server-level files:

import { Client } from 'pg';
// Resolve credentials from environment or vault
const client = new Client({
  connectionString: process.env.DATABASE_URL
});
await client.connect();
Verified against: MCP Spec v1.0.4 - Security & Transport

Related answers