API keys in servers.json

[olimorris]

I've been playing around with the Tavily adapter in MCPHub. It requires an API key and I've put this in my shell. So the relevant config looks like:

    "github.com/tavily-ai/tavily-mcp": {
      "args": ["-y", "tavily-mcp@0.1.4"],
      "env": {
        "TAVILY_API_KEY": "null"
      },
      "command": "npx"
    }

I'm not a huge fan of having API keys in the shell. It's pretty easy for a rogue app to grab them and transmit them. Of course I'm biased, but I like how in CodeCompanion, I can do cmd:op read op://personal/Tavily/credential --no-newline to read it from my 1Password fault which requires my biometrics.

Putting this out here in case it's possible to implement something similar in MCPHub.nvim.

[ravitemer]

Yes will update it soon after pushed some PRs I'm working on to codecompanion 😅. How about any vars that start with $: we assume they are to be resolved by executing them? Do you know any standard way of declaring these commands other than $:?

"TAVILY_API_KEY": "$: cmd:op read op://personal/Tavily/credential --no-newline"

Btw is this actually working? Is it a typo or did I mess up something? 😂

     "TAVILY_API_KEY": "null"

It is supposed to work for only falsy values in js null or "" etc

[olimorris]

I don't. I think $: is perfectly reasonable though.

And I've been have my Tavily key in the shell just fine 👍.

[ravitemer]

@olimorris I have updated it to work with $: cmd arg1 arg2 syntax. Please update and try it.

Note: Whenever the server is started or updated, it tries to get the latest environment, MCPHub by default has a shutdown_delay of 10 minutes i.e once you close neovim it wait for 10 minutes to shutdown. If you open neovim after 10 minutes you might have to authenticate again. To avoid this you can set the shutdown_delay option in the config to something much longer.