Enable to encrypt files of tokens on local machine

[yu-iskw]

Overview

According to my research, Toolbase persists tokens without encryption. It would be great to encrypt the files contain tokens from the security standpoint.

[gching]

Good call, yeah I selected this as the option at the time just to get it out quickly, but I had the ticket in my backlog to handle this.

The issue is because the runner for the MCP and the desktop app where the authentication happens are two different processes, there wasn't a simple solution to handle pass over a token, especially when encrypted.

I have a few ideas and would love your thoughts:

• The runner MCP calls the desktop app process, either by spinning up a child process of the desktop app or through IPC to get a ephemeral token at runtime - potentially least amount of effort, but UX would be interesting, since the desktop app would potentially open or there would be a flash of the window
• The runner logins either via OAuth or via the same OTP flow - highest effort, but would long term let non-desktop apps to access the user's MCP configuration remotely. I see Toolbase potentially moving towards remote MCP services, and this would definitely support it. However, UX would be that the user would need to log back in
• Both options, call desktop app, and if the user's not authenticated, fallback to OAuth / OTP flow

Leaning on option 1 more just to keep it more secure

[gching]

Was just thinking about this, but given how all MCP servers configurations are stored and utilized across different AI clients (Claude, Cursor, Goose) and all those credentials are stored locally as well in the filesystem, the token for remote access isn't the only thing that is exposed even if it is encrypted.

Not saying it isn't a concern, but might even lower the priority 🤔

[gching]

Would be interesting to see if there is a way for the Deno MCP runner be able to store + retrieve credentials + environment variables in the secure store of the corresponding device (ie. keychain on macOS) 🤔