s-gw — Claude Code MCP server: secrets and setup
s-gw keeps raw credentials away from coding agents and releases them to local processes only after approval. Use it when agent access needs clear boundaries.
claude mcp add s-gw -- npx -y @s-gw/s-gwWhat s-gw does
s-gw gives an agent named handles instead of exposing keys, passwords, tokens, or SSH material. The agent submits an action request, and the local operator reviews its scope, command, environment binding, working directory, and target. Once approved, the gateway passes the credential to a child process on the same machine and returns scrubbed output.
The package includes an MCP server for handle discovery and request creation, a CLI for setup and policies, a local console, and audit records. The npm route requires Node.js 20 or newer; Linux setup also uses secret-tool. This project is an early preview, and its Windows and Linux desktop support is experimental. It has not had an independent security audit, so it is not a replacement for endpoint security.
What it helps with
- keep API keys out of agent context
- require approval before a command runs
- bind access to a directory and target
- remove credential values from command output
- track requests and executions in audit records
Example prompts for the agent
- Connect s-gw and ask it for a handle that reads from the project credential store.
- Ask s-gw to run a command with a selected handle after I approve the request.
- Show the s-gw history for recent requests and approvals.
How to install s-gw
Platform CLI
claude mcp add s-gw -- npx -y @s-gw/s-gwPlatform CLI
codex mcp add s-gw -- npx -y @s-gw/s-gwConfig file
{
"mcpServers": {
"s-gw": {
"command": "npx",
"args": [
"-y",
"@s-gw/s-gw"
]
}
}
}Config file
{
"servers": {
"s-gw": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@s-gw/s-gw"
]
}
}
}Platform CLI
gemini mcp add s-gw npx -y @s-gw/s-gwStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about s-gw
How do I install s-gw in Claude Code?
Run claude mcp add s-gw -- npx -y @s-gw/s-gw. This registers the s-gw MCP server with Claude Code.
What does s-gw do?
It gives agents named handles rather than raw credentials, then passes a secret to a local child process only after a scoped approval. Returned output is scrubbed before the agent receives it.
What does s-gw require?
The npm installation requires Node.js 20 or newer. Linux setup also requires secret-tool, while Claude Code connects to the server through npx.
