configs-all 1.0.0

package/scripts/mcp/aws-mcp-wrapper.ps1

@@ -0,0 +1,97 @@
+# AWS MCP Server Wrapper (PowerShell)
+# Prioritizes AWS_PROFILE (for Duplo JIT credentials) over direct AWS credentials
+# Sources $env:USERPROFILE\.secrets and AWS config, then runs AWS MCP server
+
+function Write-ErrLine {
+    param([Parameter(Mandatory = $true)][string]$Message)
+    [Console]::Error.WriteLine($Message)
+}
+
+function Resolve-UvCommand {
+    # Prefer PATH resolution first
+    $uv = Get-Command uv -ErrorAction SilentlyContinue
+    if ($uv) { return @($uv.Source, @()) }
+
+    $uvx = Get-Command uvx -ErrorAction SilentlyContinue
+    if ($uvx) { return @($uvx.Source, @()) }
+
+    # Common Windows install locations (pip --user, pip system, rust/cargo)
+    $candidatePaths = @(
+        # pip --user typically ends up under %APPDATA%\Python\Python3xx\Scripts
+        (Join-Path $env:APPDATA "Python\Python*\Scripts\uv.exe"),
+        (Join-Path $env:APPDATA "Python\Python*\Scripts\uvx.exe"),
+        # Some Python installs place scripts under %LOCALAPPDATA%\Programs\Python\Python3xx\Scripts
+        (Join-Path $env:LOCALAPPDATA "Programs\Python\Python*\Scripts\uv.exe"),
+        (Join-Path $env:LOCALAPPDATA "Programs\Python\Python*\Scripts\uvx.exe"),
+        # cargo install locations
+        (Join-Path $env:USERPROFILE ".cargo\bin\uv.exe"),
+        (Join-Path $env:USERPROFILE ".cargo\bin\uvx.exe"),
+        (Join-Path $env:USERPROFILE ".local\bin\uv.exe"),
+        (Join-Path $env:USERPROFILE ".local\bin\uvx.exe")
+    ) | Where-Object { $_ -and $_.Trim() -ne "" }
+
+    foreach ($pattern in $candidatePaths) {
+        $match = Get-ChildItem -Path $pattern -File -ErrorAction SilentlyContinue | Select-Object -First 1
+        if ($match) { return @($match.FullName, @()) }
+    }
+
+    return $null
+}
+
+# Load secrets from .secrets file if it exists
+$secretsFile = Join-Path $env:USERPROFILE ".secrets"
+if (Test-Path $secretsFile) {
+    Get-Content $secretsFile | ForEach-Object {
+        if ($_ -match '^\s*([^#][^=]+)=(.*)$') {
+            $key = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Load repo-specific secrets if available (from direnv .envrc)
+$repoSecretsFile = Join-Path (Get-Location) ".secrets"
+if (Test-Path $repoSecretsFile) {
+    Get-Content $repoSecretsFile | ForEach-Object {
+        if ($_ -match '^\s*([^#][^=]+)=(.*)$') {
+            $key = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Priority: AWS_PROFILE first (for Duplo JIT), then fallback to direct credentials
+# Only set default profile if no profile is set AND no direct credentials exist
+if (-not $env:AWS_PROFILE) {
+    # No profile set - check if we have direct credentials
+    if (-not $env:AWS_ACCESS_KEY_ID -and -not $env:AWS_SECRET_ACCESS_KEY) {
+        # No profile and no credentials - use default profile
+        $env:AWS_PROFILE = "default"
+    }
+    # If direct credentials exist, let AWS SDK use them (don't set profile)
+}
+
+# Set region (can be overridden by direnv)
+if (-not $env:AWS_REGION) {
+    $env:AWS_REGION = "us-east-2"
+}
+
+# Resolve uv/uvx command (must avoid printing non-JSON to stdout)
+$cmd = Resolve-UvCommand
+if (-not $cmd) {
+    Write-ErrLine "Error: Neither uv nor uvx found in PATH (or common locations)."
+    Write-ErrLine "Fix: install uv (recommended) and ensure it's on PATH, then restart Cursor."
+    Write-ErrLine "Example: py -m pip install --user uv"
+    exit 1
+}
+
+# Use uv tool run (preferred). If the resolved command is uvx.exe, use uvx invocation.
+$cmdPath = $cmd[0]
+$exeName = [System.IO.Path]::GetFileName($cmdPath).ToLowerInvariant()
+if ($exeName -eq "uvx.exe") {
+    & $cmdPath "awslabs.core-mcp-server@latest" @args
+} else {
+    & $cmdPath tool run --from "awslabs.core-mcp-server@latest" "awslabs.core-mcp-server" @args
+}

package/scripts/mcp/aws-mcp-wrapper.sh

@@ -0,0 +1,53 @@
+#!/bin/zsh
+
+# AWS MCP Server Wrapper
+# Prioritizes AWS_PROFILE (for Duplo JIT credentials) over direct AWS credentials
+# Sources ~/.secrets and AWS config, then runs AWS MCP server
+
+# Source secrets if available
+if [[ -f "${HOME}/.secrets" ]]; then
+    source "${HOME}/.secrets"
+fi
+
+# Source repo-specific secrets if available (from direnv .envrc)
+if [[ -f "${PWD}/.secrets" ]]; then
+    source "${PWD}/.secrets"
+fi
+
+# Priority: AWS_PROFILE first (for Duplo JIT), then fallback to direct credentials
+# Only set default profile if no profile is set AND no direct credentials exist
+if [[ -z "${AWS_PROFILE:-}" ]]; then
+    # No profile set - check if we have direct credentials
+    if [[ -z "${AWS_ACCESS_KEY_ID:-}" ]] && [[ -z "${AWS_SECRET_ACCESS_KEY:-}" ]]; then
+        # No profile and no credentials - use default profile
+        export AWS_PROFILE="default"
+    fi
+    # If direct credentials exist, let AWS SDK use them (don't set profile)
+fi
+
+# Set region (can be overridden by direnv)
+export AWS_REGION="${AWS_REGION:-us-east-2}"
+
+# Use uv tool run (confirmed working)
+if command -v uv >/dev/null 2>&1; then
+    exec uv tool run --from awslabs.core-mcp-server@latest awslabs.core-mcp-server
+# Fallback to uvx
+elif command -v uvx >/dev/null 2>&1; then
+    exec uvx awslabs.core-mcp-server@latest
+else
+    # Fallback to pip-installed console script if available
+    if command -v awslabs.core-mcp-server >/dev/null 2>&1; then
+        exec awslabs.core-mcp-server
+    fi
+
+    # Fallback to python -m (for user/venv installs)
+    if command -v python3 >/dev/null 2>&1; then
+        exec python3 -m awslabs.core_mcp_server
+    fi
+
+    echo "Error: AWS MCP requires one of: uv/uvx, awslabs.core-mcp-server (pip), or python3 module install." >&2
+    echo "Install options:" >&2
+    echo "  - brew install uv" >&2
+    echo "  - python3 -m pip install --user awslabs.core-mcp-server" >&2
+    exit 1
+fi

package/scripts/mcp/duplo-mcp-wrapper.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+
+# Duplo Cloud MCP Server Wrapper
+# Picks up DUPLO_HOST, DUPLO_TOKEN, DUPLO_TENANT from env (set by direnv, shell, or ~/.secrets)
+
+# Ensure common bin paths are available (MCP servers run with minimal PATH)
+export PATH="/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:${PATH}"
+
+# Source secrets if available (fallback for vars not already in env)
+if [ -f "${HOME}/.secrets" ]; then
+    . "${HOME}/.secrets"
+fi
+
+# Validate required vars
+missing=""
+[ -z "${DUPLO_HOST}" ] && missing="${missing} DUPLO_HOST"
+[ -z "${DUPLO_TOKEN}" ] && missing="${missing} DUPLO_TOKEN"
+[ -z "${DUPLO_TENANT}" ] && missing="${missing} DUPLO_TENANT"
+
+if [ -n "${missing}" ]; then
+    echo "Error: Missing Duplo env vars:${missing}" >&2
+    echo "Set them via direnv, shell env, or ~/.secrets" >&2
+    exit 1
+fi
+
+exec docker run --rm -i \
+    -e "DUPLO_HOST=${DUPLO_HOST}" \
+    -e "DUPLO_TOKEN=${DUPLO_TOKEN}" \
+    -e "DUPLO_TENANT=${DUPLO_TENANT}" \
+    duplocloud/mcp:latest \
+    duplocloud-mcp --transport stdio

package/scripts/mcp/filesystem-mcp-wrapper.ps1

@@ -0,0 +1,43 @@
+# Filesystem MCP Server Wrapper (PowerShell)
+# Picks a sane Dropbox "dev root" across machines, then runs the filesystem MCP.
+
+$ErrorActionPreference = "Stop"
+
+function Resolve-FsRoot {
+    # NOTE: PowerShell variables are case-insensitive; avoid $home which conflicts with read-only $HOME.
+    $userHome = $env:USERPROFILE
+    $candidates = @(
+        (Join-Path $userHome "Dropbox\duplo\dev\chiefmikey"),
+        (Join-Path $userHome "Dropbox\dev"),
+        (Join-Path $userHome "Dropbox\mikbook\dev"),
+        (Join-Path $userHome "Dropbox\mikpc\dev"),
+        (Join-Path $userHome "Dropbox")
+    )
+
+    foreach ($d in $candidates) {
+        if (Test-Path $d) { return $d }
+    }
+
+    throw "could not resolve a filesystem root under $userHome\Dropbox"
+}
+
+function Resolve-Npx {
+    # NOTE: PowerShell variables are case-insensitive; avoid $home which conflicts with read-only $HOME.
+    $userHome = $env:USERPROFILE
+    $candidates = @(
+        "C:\Program Files\nodejs\npx.cmd",
+        (Join-Path $userHome "AppData\Roaming\npm\npx.cmd")
+    )
+
+    foreach ($p in $candidates) {
+        if (Test-Path $p) { return $p }
+    }
+
+    return "npx"
+}
+
+$root = Resolve-FsRoot
+$npx = Resolve-Npx
+
+& $npx -y "@modelcontextprotocol/server-filesystem" $root
+

package/scripts/mcp/filesystem-mcp-wrapper.sh

@@ -0,0 +1,34 @@
+#!/bin/zsh
+
+# Filesystem MCP Server Wrapper
+# Picks a sane Dropbox "dev root" across machines, then runs the filesystem MCP.
+
+set -euo pipefail
+
+resolve_fs_root() {
+  local candidates=(
+    "${HOME}/Dropbox/duplo/dev/chiefmikey"
+    "${HOME}/Dropbox/dev"
+    "${HOME}/Dropbox/mikbook/dev"
+    "${HOME}/Dropbox/mikpc/dev"
+    "${HOME}/Dropbox"
+  )
+
+  local d
+  for d in "${candidates[@]}"; do
+    if [[ -d "$d" ]]; then
+      echo "$d"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+ROOT="$(resolve_fs_root)" || {
+  echo "Error: could not resolve a filesystem root under ${HOME}/Dropbox" >&2
+  exit 1
+}
+
+exec npx -y @modelcontextprotocol/server-filesystem "$ROOT"
+

package/scripts/mcp/git-mcp-wrapper.ps1

@@ -0,0 +1,42 @@
+# Git MCP Server Wrapper (PowerShell)
+# Selects a per-machine configs repo as the git root, then runs git MCP.
+
+$ErrorActionPreference = "Stop"
+
+function Resolve-GitRoot {
+    # NOTE: PowerShell variables are case-insensitive; avoid $home which conflicts with read-only $HOME.
+    $userHome = $env:USERPROFILE
+    $candidates = @(
+        (Join-Path $userHome "Dropbox\duplo\dev\chiefmikey\configs"),
+        (Join-Path $userHome "Dropbox\dev\configs"),
+        (Join-Path $userHome "Dropbox\mikbook\dev\configs"),
+        (Join-Path $userHome "Dropbox\mikpc\dev\configs")
+    )
+
+    foreach ($d in $candidates) {
+        if (Test-Path (Join-Path $d ".git")) { return $d }
+    }
+
+    throw "could not resolve a git repo under $userHome\Dropbox\*\dev\*\configs"
+}
+
+function Resolve-Npx {
+    # NOTE: PowerShell variables are case-insensitive; avoid $home which conflicts with read-only $HOME.
+    $userHome = $env:USERPROFILE
+    $candidates = @(
+        "C:\Program Files\nodejs\npx.cmd",
+        (Join-Path $userHome "AppData\Roaming\npm\npx.cmd")
+    )
+
+    foreach ($p in $candidates) {
+        if (Test-Path $p) { return $p }
+    }
+
+    return "npx"
+}
+
+$root = Resolve-GitRoot
+$npx = Resolve-Npx
+
+& $npx -y "@cyanheads/git-mcp-server" --repository $root
+

package/scripts/mcp/git-mcp-wrapper.sh

@@ -0,0 +1,33 @@
+#!/bin/zsh
+
+# Git MCP Server Wrapper
+# Selects a per-machine configs repo as the git root, then runs git MCP.
+
+set -euo pipefail
+
+resolve_git_root() {
+  local candidates=(
+    "${HOME}/Dropbox/duplo/dev/chiefmikey/configs"
+    "${HOME}/Dropbox/dev/configs"
+    "${HOME}/Dropbox/mikbook/dev/configs"
+    "${HOME}/Dropbox/mikpc/dev/configs"
+  )
+
+  local d
+  for d in "${candidates[@]}"; do
+    if [[ -d "$d/.git" ]]; then
+      echo "$d"
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+ROOT="$(resolve_git_root)" || {
+  echo "Error: could not resolve a git repo under ${HOME}/Dropbox/*/dev/*/configs" >&2
+  exit 1
+}
+
+exec npx -y @cyanheads/git-mcp-server --repository "$ROOT"
+

package/scripts/mcp/github-mcp-wrapper.ps1

@@ -0,0 +1,43 @@
+# GitHub MCP Server Wrapper (PowerShell)
+# Sources $env:USERPROFILE\.secrets to get GITHUB_PAT and runs via npx
+
+function Write-ErrLine {
+    param([Parameter(Mandatory = $true)][string]$Message)
+    [Console]::Error.WriteLine($Message)
+}
+
+# Load secrets from .secrets file if it exists
+$secretsFile = Join-Path $env:USERPROFILE ".secrets"
+if (Test-Path $secretsFile) {
+    Get-Content $secretsFile | ForEach-Object {
+        $line = $_
+        if (-not $line) { return }
+        if ($line.Trim().StartsWith("#")) { return }
+
+        # Support common .env variants:
+        # - optional BOM at start of file
+        # - optional 'export '
+        # - optional whitespace around '='
+        # - optional quoting around values
+        if ($line -match '^\s*(?:export\s+)?([^=]+?)\s*=\s*(.*)\s*$') {
+            $key = $matches[1].Trim().TrimStart([char]0xFEFF)
+            $value = $matches[2].Trim()
+            if (($value.StartsWith('"') -and $value.EndsWith('"')) -or ($value.StartsWith("'") -and $value.EndsWith("'"))) {
+                $value = $value.Substring(1, $value.Length - 2)
+            }
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Get token from environment (set from .secrets or existing env var)
+$token = $env:GITHUB_PAT
+if (-not $token) {
+    Write-ErrLine "Error: GITHUB_PAT not found in .secrets or environment."
+    Write-ErrLine "Fix: add GITHUB_PAT=... to $env:USERPROFILE\.secrets and restart Cursor."
+    exit 1
+}
+
+# Run GitHub MCP server with token (stdio transport required)
+$env:GITHUB_PERSONAL_ACCESS_TOKEN = $token
+& npx -y @modelcontextprotocol/server-github @args

package/scripts/mcp/github-mcp-wrapper.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# GitHub MCP Server Wrapper
+# Sources ~/.secrets to get GITHUB_PAT and runs via npx
+
+# Source secrets if available
+if [ -f "${HOME}/.secrets" ]; then
+    . "${HOME}/.secrets"
+fi
+
+# Ensure token exists (avoid printing non-JSON to stdout)
+if [ -z "${GITHUB_PAT}" ]; then
+    echo "Error: GITHUB_PAT not found in ~/.secrets or environment." >&2
+    exit 1
+fi
+
+# Run GitHub MCP server with token from environment (stdio transport required)
+export GITHUB_PERSONAL_ACCESS_TOKEN="${GITHUB_PAT}"
+exec npx -y @modelcontextprotocol/server-github "$@"

package/scripts/mcp/kubernetes-mcp-wrapper.ps1

@@ -0,0 +1,22 @@
+# Kubernetes MCP Server Wrapper (PowerShell)
+# Sources $env:USERPROFILE\.secrets and respects KUBECONFIG environment variable for per-repo configs
+
+# Source secrets if available
+if (Test-Path "$env:USERPROFILE\.secrets") {
+    Get-Content "$env:USERPROFILE\.secrets" | ForEach-Object {
+        if ($_ -match '^([^#][^=]+)=(.*)$') {
+            $name = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($name, $value, "Process")
+        }
+    }
+}
+
+# Use KUBECONFIG from environment if set (allows per-repo configs via direnv)
+# If not set, defaults to ~/.kube/config
+if (-not $env:KUBECONFIG) {
+    $env:KUBECONFIG = "$env:USERPROFILE\.kube\config"
+}
+
+# Run Kubernetes MCP server
+npx -y kubernetes-mcp-server@latest

package/scripts/mcp/kubernetes-mcp-wrapper.sh

@@ -0,0 +1,16 @@
+#!/bin/zsh
+
+# Kubernetes MCP Server Wrapper
+# Sources ~/.secrets and respects KUBECONFIG environment variable for per-repo configs
+
+# Source secrets if available
+if [[ -f "${HOME}/.secrets" ]]; then
+    source "${HOME}/.secrets"
+fi
+
+# Use KUBECONFIG from environment if set (allows per-repo configs via direnv)
+# If not set, defaults to ~/.kube/config
+export KUBECONFIG="${KUBECONFIG:-${HOME}/.kube/config}"
+
+# Run Kubernetes MCP server
+exec npx -y kubernetes-mcp-server@latest

package/scripts/mcp/mcp-launcher.ps1

@@ -0,0 +1,56 @@
+# MCP Launcher (PowerShell)
+# Resolves CONFIG_DIR dynamically and launches MCP wrapper scripts
+# Usage: mcp-launcher.ps1 <wrapper-script-name>
+# Example: .\mcp-launcher.ps1 aws-mcp-wrapper.ps1
+
+$ErrorActionPreference = "Stop"
+
+function Resolve-ConfigDir {
+    # Allow explicit override
+    if ($env:CONFIG_DIR -and (Test-Path (Join-Path $env:CONFIG_DIR "scripts\mcp"))) {
+        return $env:CONFIG_DIR
+    }
+
+    # Prefer resolving from this script's location when running from the repo
+    # Repo layout: <CONFIG_DIR>\scripts\mcp\mcp-launcher.ps1
+    $scriptDir = $PSScriptRoot
+    if ($scriptDir) {
+        $potential = Resolve-Path (Join-Path $scriptDir "..\..") | Select-Object -ExpandProperty Path
+        if (Test-Path (Join-Path $potential "scripts\mcp")) {
+            return $potential
+        }
+    }
+
+    # Fall back to known locations
+    # NOTE: PowerShell variables are case-insensitive; avoid $home which conflicts with read-only $HOME.
+    $userHome = $env:USERPROFILE
+    $candidates = @(
+        (Join-Path $userHome "Dropbox\mikpc\dev\configs"),
+        (Join-Path $userHome "Dropbox\dev\configs"),
+        (Join-Path $userHome "Dropbox\duplo\dev\chiefmikey\configs"),
+        (Join-Path $userHome "Dropbox\mikbook\dev\configs")
+    )
+
+    foreach ($d in $candidates) {
+        if (Test-Path (Join-Path $d "scripts\mcp")) {
+            return $d
+        }
+    }
+
+    throw "Could not resolve CONFIG_DIR (set CONFIG_DIR env var or install configs repo in a known location)."
+}
+
+$wrapperScript = $args[0]
+if (-not $wrapperScript) {
+    throw "No wrapper script specified"
+}
+
+$configDir = Resolve-ConfigDir
+$wrapperPath = Join-Path (Join-Path $configDir "scripts\mcp") $wrapperScript
+
+if (-not (Test-Path $wrapperPath)) {
+    throw "Wrapper script not found: $wrapperPath"
+}
+
+# Execute
+& $wrapperPath

package/scripts/mcp/mcp-launcher.sh

@@ -0,0 +1,71 @@
+#!/bin/zsh
+
+# MCP Launcher - Resolves CONFIG_DIR dynamically and launches MCP wrapper scripts
+# Usage: mcp-launcher.sh <wrapper-script-name>
+# Example: mcp-launcher.sh aws-mcp-wrapper.sh
+
+set -euo pipefail
+
+resolve_config_dir() {
+    # Allow explicit override
+    if [[ -n "${CONFIG_DIR:-}" ]] && [[ -d "${CONFIG_DIR}/scripts/mcp" ]]; then
+        echo "${CONFIG_DIR}"
+        return 0
+    fi
+
+    # Prefer resolving from this script's location when running from the repo
+    # Repo layout: <CONFIG_DIR>/scripts/mcp/mcp-launcher.sh
+    local script_dir potential
+    script_dir="$(cd "$(dirname "$0")" && pwd)"
+    potential="$(cd "${script_dir}/../.." && pwd)"
+    if [[ -d "${potential}/scripts/mcp" ]]; then
+        echo "${potential}"
+        return 0
+    fi
+
+    # Fall back to known locations (multi-machine friendly)
+    local candidates=(
+        "${HOME}/Dropbox/duplo/dev/chiefmikey/configs"
+        "${HOME}/Dropbox/dev/configs"
+        "${HOME}/Dropbox/mikbook/dev/configs"
+        "${HOME}/Dropbox/mikpc/dev/configs"
+    )
+    local d
+    for d in "${candidates[@]}"; do
+        if [[ -d "${d}/scripts/mcp" ]]; then
+            echo "${d}"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+CONFIG_DIR="$(resolve_config_dir)" || {
+    echo "Error: Could not resolve CONFIG_DIR (set CONFIG_DIR env var or install configs repo in a known location)." >&2
+    exit 1
+}
+
+# Get the wrapper script name from arguments
+WRAPPER_SCRIPT="${1:-}"
+
+if [[ -z "$WRAPPER_SCRIPT" ]]; then
+    echo "Error: No wrapper script specified" >&2
+    exit 1
+fi
+
+# Resolve the full path to the wrapper script
+WRAPPER_PATH="${CONFIG_DIR}/scripts/mcp/${WRAPPER_SCRIPT}"
+
+if [[ ! -f "$WRAPPER_PATH" ]]; then
+    echo "Error: Wrapper script not found: $WRAPPER_PATH" >&2
+    exit 1
+fi
+
+# Make sure it's executable
+if [[ ! -x "$WRAPPER_PATH" ]]; then
+    chmod +x "$WRAPPER_PATH"
+fi
+
+# Execute the wrapper script
+exec "$WRAPPER_PATH"

package/scripts/mcp/mongodb-mcp-wrapper.ps1

@@ -0,0 +1,26 @@
+# MongoDB MCP Server Wrapper (PowerShell)
+# Sources $env:USERPROFILE\.secrets to get MONGODB_CONNECTION_STRING and MONGODB_DATABASE if available
+# Falls back to defaults if not set
+
+# Load secrets from .secrets file if it exists
+$secretsFile = Join-Path $env:USERPROFILE ".secrets"
+if (Test-Path $secretsFile) {
+    Get-Content $secretsFile | ForEach-Object {
+        if ($_ -match '^\s*([^#][^=]+)=(.*)$') {
+            $key = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Use values from .secrets, or defaults
+if (-not $env:MONGODB_CONNECTION_STRING) {
+    $env:MONGODB_CONNECTION_STRING = "mongodb://localhost:27017"
+}
+if (-not $env:MONGODB_DATABASE) {
+    $env:MONGODB_DATABASE = "devopsmgr"
+}
+
+# Run MongoDB MCP server
+npx -y @mongodb-js/mongodb-mcp-server

package/scripts/mcp/mongodb-mcp-wrapper.sh

@@ -0,0 +1,17 @@
+#!/bin/zsh
+
+# MongoDB MCP Server Wrapper
+# Sources ~/.secrets to get MONGODB_CONNECTION_STRING and MONGODB_DATABASE if available
+# Falls back to defaults if not set
+
+# Source secrets if available
+if [[ -f "${HOME}/.secrets" ]]; then
+    source "${HOME}/.secrets"
+fi
+
+# Use values from .secrets, or defaults
+export MONGODB_CONNECTION_STRING="${MONGODB_CONNECTION_STRING:-mongodb://localhost:27017}"
+export MONGODB_DATABASE="${MONGODB_DATABASE:-devopsmgr}"
+
+# Run MongoDB MCP server
+exec npx -y @mongodb-js/mongodb-mcp-server

package/scripts/mcp/notion-mcp-wrapper.ps1

@@ -0,0 +1,23 @@
+# Notion MCP Server Wrapper (PowerShell)
+# Sources $env:USERPROFILE\.secrets to get INTERNAL_INTEGRATION_TOKEN and passes it to Docker container
+
+# Load secrets from .secrets file if it exists
+$secretsFile = Join-Path $env:USERPROFILE ".secrets"
+if (Test-Path $secretsFile) {
+    Get-Content $secretsFile | ForEach-Object {
+        if ($_ -match '^\s*([^#][^=]+)=(.*)$') {
+            $key = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Get token from environment (set from .secrets or existing env var)
+$token = $env:INTERNAL_INTEGRATION_TOKEN
+if (-not $token) {
+    Write-Host "Warning: INTERNAL_INTEGRATION_TOKEN not found in .secrets or environment" -ForegroundColor Yellow
+}
+
+# Run Notion MCP server with token
+docker run -i --rm -e "INTERNAL_INTEGRATION_TOKEN=$token" mcp/notion

package/scripts/mcp/notion-mcp-wrapper.sh

@@ -0,0 +1,14 @@
+#!/bin/zsh
+
+# Notion MCP Server Wrapper
+# Sources ~/.secrets to get INTERNAL_INTEGRATION_TOKEN and passes it to Docker container
+
+# Source secrets if available
+if [[ -f "${HOME}/.secrets" ]]; then
+    source "${HOME}/.secrets"
+fi
+
+# Run Notion MCP server with token from environment
+exec docker run -i --rm \
+    -e "INTERNAL_INTEGRATION_TOKEN=${INTERNAL_INTEGRATION_TOKEN}" \
+    mcp/notion

package/scripts/mcp/postgres-mcp-wrapper.ps1

@@ -0,0 +1,23 @@
+# Postgres MCP Server Wrapper (PowerShell)
+# Sources $env:USERPROFILE\.secrets to get POSTGRES_CONNECTION_STRING if available
+# Falls back to default if not set
+
+# Load secrets from .secrets file if it exists
+$secretsFile = Join-Path $env:USERPROFILE ".secrets"
+if (Test-Path $secretsFile) {
+    Get-Content $secretsFile | ForEach-Object {
+        if ($_ -match '^\s*([^#][^=]+)=(.*)$') {
+            $key = $matches[1].Trim()
+            $value = $matches[2].Trim()
+            [Environment]::SetEnvironmentVariable($key, $value, "Process")
+        }
+    }
+}
+
+# Use POSTGRES_CONNECTION_STRING from .secrets, or default
+if (-not $env:POSTGRES_CONNECTION_STRING) {
+    $env:POSTGRES_CONNECTION_STRING = "postgresql://localhost:5432/postgres"
+}
+
+# Run Postgres MCP server
+npx -y @modelcontextprotocol/server-postgres