Purpose

serveMyAPI is a personal-use MCP (Model Context Protocol) server whose main purpose is to securely store and access API keys locally and allow these keys to be reused across projects. It stores keys in the macOS Keychain and accesses them through a unified MCP interface, thereby avoiding writing keys into .env files or configuration files.

The official description emphasizes security first: serveMyAPI is designed to run only on the local machine, API keys are never transmitted over the internet, and it should never be deployed to cloud services.

Main Capabilities

Securely store API keys in the macOS Keychain.
Provide simple MCP tools for storing, retrieving, listing, and deleting keys.
Provide a convenient CLI interface for managing keys in the terminal.
Support both stdio and HTTP/SSE transport methods (HTTP with authentication).
Compatible with any MCP client (such as Claude Desktop, etc.).
Cross-platform storage abstraction layer:
- macOS: uses the native Keychain (default).
- Windows/Linux: uses encrypted file storage.
- Docker: automatically uses encrypted file storage.
- Memory: for testing and temporary storage.

Advantages Over .ENV Files (Officially Listed)

Resolves the GitHub security conflict: .ENV files need to be excluded via .gitignore, which makes configuration invisible to collaborators and LLMs (the "hidden context" problem), and makes it difficult for new developers to set environment variables correctly.
Improves LLM integration: LLMs such as Claude cannot directly access .ENV files due to security restrictions, while serveMyAPI allows AI assistants to request keys through natural language.
Cross-project consistency: .ENV files usually require duplicating keys across multiple projects, and changes require updating multiple files; serveMyAPI provides a central storage location accessible from any project.

Usage

Command-Line Interface

serveMyAPI provides a CLI for quickly managing keys in the terminal.

Run as a stdio server: this is the simplest way, especially suitable for use with Claude Desktop.

Run as an HTTP server: suitable for applications that need HTTP access.After startup, it listens on port 3000 by default (or the port specified by the PORT environment variable).

Configure the MCP Client

serveMyAPI can be used with any MCP-compatible client, and example configuration files are provided in the examples directory.

Taking Claude Desktop as an example:

Find or create the Claude Desktop configuration file:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %AppData%\Claude\claude_desktop_config.json
Add serveMyAPI in the mcpServers section (you can copy it from examples/claude_desktop_config.json):

{
  "mcpServers": {
    "serveMyAPI": {
      "command": "node",
      "args": ["/ABSOLUTE/PATH/TO/servemyapi/dist/index.js"]
    }
  }
}

Replace /ABSOLUTE/PATH/TO/servemyapi with the actual serveMyAPI installation path.
Restart Claude Desktop.

Taking Windsurf as an example:

Open the Windsurf editor and go to Settings.
Using the example in examples/windsurf_config.json, add serveMyAPI to the MCP server configuration.
Adjust the path according to your local installation.

Exposed Tools

Store API key: parameters name (key name/identifier), key (the API key to store).
Retrieve API key: parameter name (the key name/identifier to retrieve).
Delete API key: parameter name (the key name/identifier to delete).
List all stored API keys: no parameters required.

Storage Options

serveMyAPI automatically selects the best storage provider based on the platform:

Automatic platform detection: macOS uses Keychain (default); Windows, Linux, and Docker use encrypted file storage.
Manual configuration: can override the automatic detection result.

Features of each storage method:

Keychain storage (macOS only): native OS-level security; no encryption required; requires user authorization on first use.
File storage (cross-platform): AES-256-GCM encryption; PBKDF2 key derivation; stored by default at ~/.servemyapi/keys.json.enc; requires the ENCRYPTION_KEY environment variable.
In-memory storage (testing): stored only in memory; data is lost after restart; used for testing and development.

Security Features

Core security features:

Platform-aware storage: automatically selects secure storage for each platform.
macOS Keychain storage: API keys are stored in the macOS Keychain with native OS-level security.
Encrypted file storage: cross-platform support for AES-256-GCM encryption.
Docker encryption: when running in Docker, keys are encrypted using AES-256-GCM with PBKDF2 key derivation.
Authentication: HTTP/SSE endpoints require Bearer token authentication.
Input validation: strictly validate to prevent path traversal and injection attacks.
Rate limiting: prevent abuse through configurable request limits.
Secure logging: all log output automatically redacts sensitive data.

HTTP server security recommendations (official):

Include a Bearer token in requests.
Always use HTTPS in production, deployed behind a reverse proxy with TLS.
Set a strong authentication key, which can be generated using openssl rand -base64 32.
Run as non-root (the Docker image automatically uses a restricted user).
Rotate keys regularly, periodically updating authentication and encryption keys.
Monitor access logs, watching for suspicious patterns or unauthorized attempts.

For detailed security configuration, see docs/SECURITY.md.

Important Security Warning

Official warning: do not use the Smithery hosted version to store real API keys. Smithery deployments are for demonstration only. Using it will:

Transmit your API keys over the internet (even with HTTPS, this violates the principle of keeping keys stored locally).
Store the keys on someone else's servers (Smithery infrastructure).
Potentially expose the keys to the service operator, or expose them in the event of a breach.

serveMyAPI is designed to run only on the local machine, and the entire security model depends on keys never leaving the local environment.

Use Cases

Developers who need to reuse the same set of API keys across multiple projects.
Those who want LLMs such as Claude to request keys in natural language when access to a service is needed.
Scenarios where you do not want to write sensitive credentials into .env or configuration files, but still want collaborators and AI tools to be able to obtain the configuration they need.

Limitations

By default, it is designed to run locally and should not be deployed to cloud services.
macOS uses the keychain by default; Windows/Linux and Docker rely on encrypted file storage and require the ENCRYPTION_KEY environment variable.
In-memory storage loses data after a restart and is for testing only.
Officially, it is explicitly not recommended to use the Smithery hosted version to store real keys.

Future Plans (officially listed)

Code scanning tool: automatically scan codebases for API endpoints, sensitive URLs, and environment variables, and suggest names to store in the keychain.
Cross-platform support: research secure credentialstorage solutions for Windows and Linux.
Integration with popular frameworks: provide convenient integration for frameworks such as Next.js and Express.
Key management UI: a simple web interface for directly managing stored API keys.

(The above features are planned and not yet available.)

serveMyAPI

About this tool