Agent setup (MCP)

Foostash ships a local MCP server so coding agents can set up Foostash without ever seeing a secret value.

json

{
  "mcpServers": {
    "foostash": {
      "command": "foostash",
      "args": ["mcp"]
    }
  }
}

The MCP server runs on your machine over stdio and reuses the same local files as the CLI: ~/.foostash/config.yaml, the master key, and .foostash.yaml in the project directory.

Tools

inspect — report local config, project config, master-key presence, and optional server health.
server_setup_plan — plan a local Docker Compose server install. No files are written.
server_setup_apply — apply a generated plan, start Docker Compose, and verify /v1/health.
identity_setup — register a new org or join with an invite using a local SSH key.
project_setup — create or reconnect a project, ensure environments, and write .foostash.yaml.
environment_sync — read a local dotenv file, encrypt changed values locally, and bulk-upload ciphertext.

Safety model

The agent never receives private keys, master keys, invite tokens, or plaintext secret values.
environment_sync accepts a file path, not raw values, and returns counts plus key names only.
Server setup defaults to 127.0.0.1:8400. If you bind publicly, terminate TLS in front.
Deletes, rollbacks, revocation, and role changes are intentionally not exposed in the first MCP release.

Example prompts

text

Use Foostash to inspect this project and tell me what's missing.

Plan a local Foostash server setup, then ask before applying it.

Create a Foostash project named payments-api with dev, staging, and prod environments.

Sync .env.local into the dev Foostash environment. Do not print secret values.