5b58460618
codex's config.toml held nine live API keys inline under
[mcp_servers.*.env] -- deepseek, gemini, kimi, mimo, qwen, glm, cursor,
an OpenAI key and a Home Assistant token -- so it could not be tracked
as it stood. TOML env tables take literal values only, with no ${VAR}
indirection or env_file, so the keys cannot simply be named there.
Move them to ~/.codex/secrets.env (0600, ignored) and route the four
affected servers through mcp-with-secrets.sh, which sources that file
and execs the real command. Doing it in the wrapper rather than relying
on exported shell vars means it does not depend on how codex handles
environment inheritance, and works on ssh-only boxes with no keychain or
1Password agent, which is why this was preferred over a chezmoi
template.
Adds configs for claude, codex, pi, grok, kimi, kimi-code and reasonix,
and extends .chezmoiignore so credentials, session logs, local state and
.bak files stay out even if a directory is ever added whole.
Held back for still containing live keys: opencode.json (bailian), and
reasonix config.json and .env.
29 lines
842 B
Bash
29 lines
842 B
Bash
#!/bin/sh
|
|
|
|
# Launch an MCP server with its secrets loaded from a machine-local file.
|
|
#
|
|
# codex's [mcp_servers.*.env] tables only take literal values, so keeping API
|
|
# keys out of config.toml means they cannot be named there at all. This wrapper
|
|
# sources them itself and then execs the real server, which works no matter how
|
|
# codex handles environment inheritance, and needs no shell rc to have run --
|
|
# useful on the ssh-only boxes where a GUI keychain or 1Password is not around.
|
|
#
|
|
# The secrets file is not tracked by chezmoi; see .chezmoiignore.
|
|
|
|
set -eu
|
|
|
|
secrets="${CODEX_MCP_SECRETS:-${CODEX_HOME:-$HOME/.codex}/secrets.env}"
|
|
|
|
if [ -r "$secrets" ]; then
|
|
. "$secrets"
|
|
else
|
|
echo "mcp-with-secrets: no secrets file at $secrets" >&2
|
|
fi
|
|
|
|
[ "$#" -gt 0 ] || {
|
|
echo "mcp-with-secrets: no command given" >&2
|
|
exit 2
|
|
}
|
|
|
|
exec "$@"
|