Use scoped MCP tokens instead of one shared .env file
CertLocker is a DevOps for secrets and tokens, with a focus here on safer MCP agent access. Claude and MCP agents can be used for real client work such as reports, scripts, standard procedures, campaign checks, and small . The access problem appears when staff and in different countries all need credentials to do their work.
A single shared .env file can end up holding AI provider keys, client advertising tokens, OAuth access, webhook secrets, GitHub tokens, and procedure repository access. Once that file is shared, a contractor working on Client A may also be able to see Client B credentials. An agent checking procedures may also be able to read webhook secrets or tokens that it does not need.
Scoped MCP tokens aim to give each person or agent only the access needed for a specific job.
Key points
- A shared .env file can mix credentials for many clients and tools in one place.
- Claude and MCP agents are being used for reports, scripts, procedures, campaign checks, and small automation work.
- Sharing one credential file can give people or agents more access than their task needs.
- Scoped MCP tokens are meant to limit access by person, agent, client, or task.
- The main value is safer agent operations, not lower model token cost.