MCP for agents

Let an AI agent list your services and rotate the variables you allow it to, while values stay encrypted and write-only by default.

What it is

dynv mcp is a Model Context Protocol server that runs on your machine, over stdio, started by your agent app. It holds your master token locally and encrypts everything before calling the Dynv API, so our servers still only see ciphertext.

Be clear about the one place plaintext does travel: a value an agent sets passes through that agent's context, because the agent wrote it. What the server does not do is send values back to the agent, unless you turn that on.

Before you start

1. Install the CLI (Quickstart).
2. Save a master token to a file only you can read. For an agent that should change variables you need a writer token (your recovery kit from sign-up); a read-only recovery token works for everything except writes.
   shCopy

   mkdir -p ~/.config/dynv
   cp ~/recovery-kit.txt ~/.config/dynv/master.token
   chmod 600 ~/.config/dynv/master.token

3. Decide what the agent may touch (below). The safe default is read-only.

Setup

Point your agent at dynv mcp with the two environment variables it needs. The examples let the agent change variables named PROXY_* and nothing else.

Claude Code

claude mcp add dynv \
  -e DYNV_URL=https://api.dynv.dev \
  -e DYNV_MASTER_TOKEN_FILE=$HOME/.config/dynv/master.token \
  -- dynv mcp --allow-keys 'PROXY_*'

Read-only instead: drop --allow-keys (or add --read-only).

Claude Desktop

Edit claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/), then restart the app.

{
  "mcpServers": {
    "dynv": {
      "command": "/usr/local/bin/dynv",
      "args": ["mcp", "--allow-keys", "PROXY_*"],
      "env": {
        "DYNV_URL": "https://api.dynv.dev",
        "DYNV_MASTER_TOKEN_FILE": "/Users/you/.config/dynv/master.token"
      }
    }
  }
}

Cursor

Put this in ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project; do not commit a token path you would not share).

{
  "mcpServers": {
    "dynv": {
      "command": "/usr/local/bin/dynv",
      "args": ["mcp", "--allow-keys", "PROXY_*"],
      "env": {
        "DYNV_URL": "https://api.dynv.dev",
        "DYNV_MASTER_TOKEN_FILE": "/home/you/.config/dynv/master.token"
      }
    }
  }
}

Desktop apps often do not inherit your shell's PATH, so use the absolute path from which dynv. The token goes in a file (DYNV_MASTER_TOKEN_FILE), not inline, so it never lands in a config you might share.

What the agent gets

--read-only removes every write tool, whatever else you passed. Tools the agent should not have simply do not exist in its list.

Allowed keys: --allow-keys

Writes are opt-in by allow-list. Without --allow-keys the agent has no set_vars or unset_vars at all. Give it patterns; * matches any run of characters. Repeat the flag for more:

dynv mcp --allow-keys 'PROXY_*' --allow-keys 'FEATURE_*' --allow-keys LOG_LEVEL

• A name must match at least one pattern, or the call fails with a message saying so. This applies to every key in a call, so one disallowed key rejects the whole call.
• A pattern that matches everything (*, **, empty) is rejected and the server refuses to start. A deny-list of "bad" names is not a security boundary, so there is no way to say "everything except".
• Quote patterns so your shell does not expand them.

Dangerous keys are always refused

Variables that control how a program starts or loads code are effectively code execution. Over MCP, set_vars and unset_vars always refuse them, even if your allow-list would match. This includes NODE_OPTIONS, NODE_PATH, PATH, HOME, SHELL, LD_*, DYLD_*, PYTHONPATH, PERL5OPT, RUBYOPT, JAVA_TOOL_OPTIONS, CLASSPATH, SSL_CERT_FILE, GIT_SSH_COMMAND, GIT_CONFIG_*, EDITOR, BASH_ENV and similar. Only a person at the CLI can set them, with dynv admin set --allow-dangerous. Names starting with DYNV_ are never valid.

Reading values: --allow-reveal

By default an agent can see that PROXY_PASSWORD exists and how long it is, never what it is. --allow-reveal lets get_vars return plaintext when the agent passes reveal: true. Leave it off unless the agent really needs to read secrets, because once a value is in its context it is in the transcript.

Minting tokens: --allow-token-create

Off by default. When on, create_token makes a service token and writes it to a file in --token-dir (default ~/.dynv/tokens), mode 0600, named by the token's random id. The agent receives the path, never the secret.

Example prompts

With the Claude Code setup above:

• "List my Dynv services and tell me which tokens have not been seen in a while."
• "Which variables does scraper-eu have, and which of them restart the process when changed?"
• "Our proxy was burned. Set PROXY_SERVER to http://p2.example:8000 on scraper-eu and scraper-us, hot."
• "Remove FEATURE_NEW_CHECKOUT from web."
• "Show me the last 20 audit events and summarise anything that failed."

Ask it to change DATABASE_URL and it will tell you the key is not in the server's allow-list. That is the policy working.

All flags

Usage: dynv mcp [OPTIONS]

Options:
      --allow-reveal             Allow agents to read plaintext values back (off by default)
      --read-only
      --allow-token-create       Allow agents to mint process tokens (written to --token-dir). An agent that can also read files as this user could read them: only enable where the agent has no filesystem access, or a different OS user owns --token-dir
      --allow-process-admin      Expose create_process and revoke_token to agents (off by default)
      --allow-keys <ALLOW_KEYS>  Restrict which variables agents may set/unset (glob, repeatable), e.g. --allow-keys 'PROXY_*'
      --token-dir <TOKEN_DIR>
  -h, --help                     Print help

Full CLI reference: dynv mcp.