I run fifteen MCP servers in Claude Code and most of them need an API key. Every setup guide tells you to paste it into the env block of .mcp.json. For Stripe that means a live key in a file I sync between machines. Wrapping each server in `infisical run` fixed that, right up until the CLI login expired. Then every server failed to start at the same moment, and the error pointed at the MCP client, not at the login. mcp-secrets-runner sits between the client and the server. It authenticates with credentials built for unattended use (Infisical machine identity, 1Password service account, Vault AppRole), fetches the secrets and execs the real server. There's a `doctor` command too, because "my MCP server won't start" is almost always one of four things and the client reports all four the same way. A few details, each there because the alternative broke something for me: diagnostics go only to stderr, since one stray byte on stdout corrupts JSON-RPC. It fails closed instead of falling back to a browser login that hangs the server forever. Tokens are cached, so ten servers starting at once don't do ten logins. AWS Secrets Manager and Doppler would both fit as providers. PRs welcome. GitHub: https://github.com/wiktormalyska... npm: https://www.npmjs.com/package/mc...

mcp-secrets-runner

Keep live API keys out of your .mcp.json

Keep live API keys out of your .mcp.json