@awesomate/hosting-mcp/skill/awesomate-credentials/scripts/capture-secret.mjs

Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases

#!/usr/bin/env node
/**
 * Securely scrub a secret-inbox file after its value has been captured and
 * stored (via awesomate_app_set_env). Overwrites the file contents with random
 * bytes, then removes it, so the plaintext secret doesn't linger on disk.
 *
 * Usage:  node capture-secret.mjs <path-to-inbox-file>
 *
 * Prints only a non-sensitive confirmation — never the file contents. The
 * capturing step (reading the value + calling awesomate_app_set_env) is done by
 * Claude with the MCP tool; this script's single job is the safe wipe.
 */

import { statSync, writeFileSync, rmSync } from 'node:fs';
import { randomBytes } from 'node:crypto';

const target = process.argv[2];
if (!target) {
  console.error('usage: node capture-secret.mjs <path-to-inbox-file>');
  process.exit(2);
}

let size = 0;
try {
  size = statSync(target).size;
} catch {
  console.log(`nothing to scrub: ${target} does not exist`);
  process.exit(0);
}

try {
  // Overwrite with random bytes of the same length, then delete. Best-effort
  // (a single pass is enough on modern storage for this threat model — the
  // point is not leaving the plaintext readable at the known path).
  if (size > 0) writeFileSync(target, randomBytes(size), { flag: 'w' });
  rmSync(target, { force: true });
  console.log(`scrubbed ${target} (${size} bytes overwritten + removed)`);
} catch (err) {
  console.error(`failed to scrub ${target}: ${err instanceof Error ? err.message : String(err)}`);
  process.exit(1);
}