@awesomate/hosting-mcp
Version:
Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases
30 lines (25 loc) • 2.07 kB
Markdown
# Where a secret goes
| The secret is… | Put it… | How |
|---|---|---|
| An app runtime secret (API key the backend calls, a third-party token, a DB URL) | The app's `.env` **and** the hub's encrypted store | Not yet revealed → secret-drop link with `--hub-app` (value never enters the chat). Already exposed → `awesomate_app_set_env` (tool). Both encrypt hub-side + inject into `.env` (0600) + restart the app |
| An n8n webhook URL the app calls (`N8N_WEBHOOK_URL`) | Same as above | `awesomate_app_set_env` — it's not secret-secret, but it belongs in `.env` with the rest |
| A personal key the user just wants kept (not used by a running app) | `~/.config/api-keys.env` (chmod 600) | Secret-drop link in file mode (the default); add a `# pasted in chat <date> — rotate` note if it came through chat instead |
| Anything, ever | **NOT** in code, a tracked file, a commit, or the chat transcript | — |
## Why two places for app secrets
The hub's encrypted `hosted_app_env_secrets` row is the **durable source of
truth** (survives redeploys, is auditable, uses the same AES-256-GCM as the DB
password). The host `.env` is what the **running process actually reads**
(`dotenv/config`). Both the secret-drop `--hub-app` flow and
`awesomate_app_set_env` write both in one step — they share the same hub route.
## Redaction pattern
When you confirm, show at most a short prefix:
- `sk-proj-abc…` → `OPENAI_API_KEY = sk-proj-…redacted`
- a DB URL → `DATABASE_URL = postgresql://…redacted`
Never the full value. Keys captured through the secret-drop link need no
redaction gymnastics — you never saw the value; confirm with the name alone.
## Rotation note (keys that entered the conversation)
A value pasted into the conversation — or read from a file into context — is in
the transcript; treat it as exposed. After storing it, tell the user once:
*"rotate this when convenient, and next time I'll give you a secret-drop link
so it never touches the chat."*
High-value keys (payment, production DB, cloud root) — recommend rotating now.