infisical-mcp 1.0.0

package/README.md

@@ -0,0 +1,21 @@
+# infisical-mcp
+
+Infisical API: list, read, create, update and delete secrets via universal auth.
+
+## Setup
+
+```bash
+export INFISICAL_CLIENT_ID=...
+```
+
+Needs an Infisical machine identity (client id + secret). Optional INFISICAL_SITE_URL for self-hosted instances.
+
+## Tools
+
+- `list_secrets` — Secrets in an Infisical project environment and path.
+- `get_secret` — Single Infisical secret value by key.
+- `create_secret` — Create an Infisical secret. Fails if the key already exists (use update).
+- `update_secret` — Change an existing Infisical secret value.
+- `delete_secret` — Delete an Infisical secret by key.
+
+Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).

package/dist/api.d.ts

@@ -0,0 +1,9 @@
+export declare class InfisicalError extends Error {
+    constructor(message: string);
+}
+export declare function errorMessage(e: unknown): string;
+export declare function listSecrets(projectId: string, environment?: string, secretPath?: string): Promise<string>;
+export declare function getSecret(projectId: string, key: string, environment?: string, secretPath?: string): Promise<string>;
+export declare function createSecret(projectId: string, key: string, value: string, environment?: string, secretPath?: string): Promise<string>;
+export declare function updateSecret(projectId: string, key: string, value: string, environment?: string, secretPath?: string): Promise<string>;
+export declare function deleteSecret(projectId: string, key: string, environment?: string, secretPath?: string): Promise<string>;

package/dist/api.js

@@ -0,0 +1,108 @@
+export class InfisicalError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "InfisicalError";
+    }
+}
+export function errorMessage(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+const UA = { "User-Agent": "awesome-mcps/1.0" };
+function envStrict(name) {
+    const v = process.env[name];
+    if (!v)
+        throw new InfisicalError(`Set the ${name} environment variable.`);
+    return v;
+}
+let cachedToken = "";
+let tokenExpiresAt = 0;
+async function authHeaders() {
+    const now = Date.now();
+    if (!cachedToken || now >= tokenExpiresAt) {
+        const site = process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com";
+        const res = await fetch(`${site}/api/v1/auth/universal-auth/login`, {
+            method: "POST",
+            headers: { ...UA, "Content-Type": "application/json" },
+            body: JSON.stringify({ clientId: envStrict("INFISICAL_CLIENT_ID"), clientSecret: envStrict("INFISICAL_CLIENT_SECRET") }),
+        });
+        if (!res.ok)
+            throw new InfisicalError(`Infisical login failed: HTTP ${res.status}`);
+        const data = (await res.json());
+        if (!data.accessToken)
+            throw new InfisicalError("Infisical login returned no access token");
+        cachedToken = data.accessToken;
+        tokenExpiresAt = now + (data.expiresIn ?? 7200) * 1000 - 60000;
+    }
+    return { Authorization: "Bearer " + cachedToken };
+}
+function pretty(data) {
+    const t = typeof data === "string" ? data : JSON.stringify(data, null, 2);
+    return t.length > 12000 ? t.slice(0, 12000) + "\n…(truncated)" : t;
+}
+async function req(url, init = {}) {
+    const res = await fetch(url, { headers: { ...UA, ...(await authHeaders()), ...(init.headers ?? {}) }, ...init });
+    const ct = res.headers.get("content-type") ?? "";
+    const data = ct.includes("json") ? await res.json() : await res.text();
+    if (!res.ok) {
+        const detail = typeof data === "string" ? data.slice(0, 300) : JSON.stringify(data).slice(0, 300);
+        throw new InfisicalError(`HTTP ${res.status}: ${detail}`);
+    }
+    return data;
+}
+export async function listSecrets(projectId, environment, secretPath) {
+    const site = (process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com").replace(/\/$/, "");
+    let url = `${site}/api/v3/secrets/raw`;
+    const qs = new URLSearchParams();
+    qs.append("workspaceId", String(projectId));
+    if (environment !== undefined)
+        qs.append("environment", String(environment));
+    if (secretPath !== undefined)
+        qs.append("secretPath", String(secretPath));
+    const qstr = qs.toString();
+    if (qstr)
+        url += (url.includes('?') ? '&' : '?') + qstr;
+    const data = await req(url);
+    return pretty(data);
+}
+export async function getSecret(projectId, key, environment, secretPath) {
+    const site = (process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com").replace(/\/$/, "");
+    let url = `${site}/api/v3/secrets/raw/${encodeURIComponent(String(key))}`;
+    const qs = new URLSearchParams();
+    qs.append("workspaceId", String(projectId));
+    if (environment !== undefined)
+        qs.append("environment", String(environment));
+    if (secretPath !== undefined)
+        qs.append("secretPath", String(secretPath));
+    const qstr = qs.toString();
+    if (qstr)
+        url += (url.includes('?') ? '&' : '?') + qstr;
+    const data = await req(url);
+    return pretty(data);
+}
+export async function createSecret(projectId, key, value, environment, secretPath) {
+    const site = (process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com").replace(/\/$/, "");
+    let url = `${site}/api/v3/secrets/raw/${encodeURIComponent(String(key))}`;
+    const data = await req(url, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ workspaceId: projectId, environment, secretPath, secretKey: key, secretValue: value }) });
+    return pretty(data);
+}
+export async function updateSecret(projectId, key, value, environment, secretPath) {
+    const site = (process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com").replace(/\/$/, "");
+    let url = `${site}/api/v3/secrets/raw/${encodeURIComponent(String(key))}`;
+    const data = await req(url, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ workspaceId: projectId, environment, secretPath, secretKey: key, secretValue: value }) });
+    return pretty(data);
+}
+export async function deleteSecret(projectId, key, environment, secretPath) {
+    const site = (process.env.INFISICAL_SITE_URL ?? "https://app.infisical.com").replace(/\/$/, "");
+    let url = `${site}/api/v3/secrets/raw/${encodeURIComponent(String(key))}`;
+    const qs = new URLSearchParams();
+    qs.append("workspaceId", String(projectId));
+    if (environment !== undefined)
+        qs.append("environment", String(environment));
+    if (secretPath !== undefined)
+        qs.append("secretPath", String(secretPath));
+    const qstr = qs.toString();
+    if (qstr)
+        url += (url.includes('?') ? '&' : '?') + qstr;
+    const data = await req(url, { method: "DELETE" });
+    return pretty(data);
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -0,0 +1,12 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createServer } from "./server.js";
+async function main() {
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("MCP server running on stdio");
+}
+main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+});

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;

package/dist/server.js

@@ -0,0 +1,105 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { errorMessage, listSecrets, getSecret, createSecret, updateSecret, deleteSecret, } from "./api.js";
+const text = (t) => ({ content: [{ type: "text", text: t }] });
+const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
+const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
+const NON_READ_ONLY = { openWorldHint: true };
+export function createServer() {
+    const server = new McpServer({
+        name: "infisical-mcp",
+        version: "1.0.0",
+    });
+    server.registerTool("list_secrets", {
+        title: "List secrets",
+        description: "Secrets in an Infisical project environment and path.",
+        inputSchema: z.object({
+            projectId: z.string().describe("Project id"),
+            environment: z.string().default("dev").describe("Environment slug"),
+            secretPath: z.string().default("/").describe("Secret path"),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ projectId, environment, secretPath }) => {
+        try {
+            return text(await listSecrets(projectId, environment, secretPath));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("get_secret", {
+        title: "Get one secret",
+        description: "Single Infisical secret value by key.",
+        inputSchema: z.object({
+            projectId: z.string().describe("Project id"),
+            environment: z.string().default("dev").describe("Environment"),
+            secretPath: z.string().default("/").describe("Path"),
+            key: z.string().describe("Secret key"),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ projectId, environment, secretPath, key }) => {
+        try {
+            return text(await getSecret(projectId, environment, secretPath, key));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("create_secret", {
+        title: "Create secret",
+        description: "Create an Infisical secret. Fails if the key already exists (use update).",
+        inputSchema: z.object({
+            projectId: z.string().describe("Project id"),
+            environment: z.string().default("dev").describe("Environment"),
+            secretPath: z.string().default("/").describe("Path"),
+            key: z.string().describe("Secret key"),
+            value: z.string().describe("Secret value"),
+        }),
+        annotations: NON_READ_ONLY,
+    }, async ({ projectId, environment, secretPath, key, value }) => {
+        try {
+            return text(await createSecret(projectId, environment, secretPath, key, value));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("update_secret", {
+        title: "Update secret",
+        description: "Change an existing Infisical secret value.",
+        inputSchema: z.object({
+            projectId: z.string().describe("Project id"),
+            environment: z.string().default("dev").describe("Environment"),
+            secretPath: z.string().default("/").describe("Path"),
+            key: z.string().describe("Secret key"),
+            value: z.string().describe("New value"),
+        }),
+        annotations: NON_READ_ONLY,
+    }, async ({ projectId, environment, secretPath, key, value }) => {
+        try {
+            return text(await updateSecret(projectId, environment, secretPath, key, value));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("delete_secret", {
+        title: "Delete secret",
+        description: "Delete an Infisical secret by key.",
+        inputSchema: z.object({
+            projectId: z.string().describe("Project id"),
+            environment: z.string().default("dev").describe("Environment"),
+            secretPath: z.string().default("/").describe("Path"),
+            key: z.string().describe("Secret key"),
+        }),
+        annotations: NON_READ_ONLY,
+    }, async ({ projectId, environment, secretPath, key }) => {
+        try {
+            return text(await deleteSecret(projectId, environment, secretPath, key));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    return server;
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "infisical-mcp",
+  "version": "1.0.0",
+  "description": "Infisical API: list, read, create, update and delete secrets via universal auth.",
+  "type": "module",
+  "mcpName": "io.github.mrfentmen/infisical-mcp",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mrfentmen/awesome-mcps.git"
+  },
+  "bin": {
+    "infisical-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "dev": "rm -rf dist && tsc -p tsconfig.json && node dist/index.js",
+    "inspect": "npx @modelcontextprotocol/inspector node dist/index.js"
+  },
+  "keywords": [
+    "mcp",
+    "infisical",
+    "secrets",
+    "devops",
+    "security"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}