MCP tokens

Session.SetMCPTokens on the one SDK, pkg/abox.

Overrides a Bearer token on the host MCP broker. Configure servers with abox mcp add first. Open already resolves tokens from the OS keystore / credentials.env / cloud sources; this example is the live override path. Keys are destination env names (GITHUB_MCP_TOKEN, or ABOX_MCP_<NAME>_TOKEN).

CLI

Configure the server on the host, then login. Tokens never enter the guest.

abox mcp add --mode direct --credential-env GITHUB_MCP_TOKEN github https://api.githubcopilot.com/mcp/
abox mcp login github
abox

/mcp in the TUI pastes a Bearer for a server that already exists. Default token env if you omit --credential-env is ABOX_MCP_<NAME>_TOKEN.

SetMCPTokens is a live override for this process (SDK). MCP.

SDK

To run this sample:

export ABOX_MCP_TOKEN_ENV=ABOX_MCP_GH_TOKEN
export ABOX_MCP_TOKEN=…   # not a real key in docs

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/AdminTurnedDevOps/ABox/pkg/abox"
)

func main() {
	ctx := context.Background()
	sess, err := abox.Open(ctx, abox.Options{})
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	defer sess.Close()
	env := os.Getenv("ABOX_MCP_TOKEN_ENV")
	tok := os.Getenv("ABOX_MCP_TOKEN")
	if env == "" || tok == "" {
		fmt.Fprintln(os.Stderr, "set ABOX_MCP_TOKEN_ENV (host credential dest, e.g. GITHUB_MCP_TOKEN) and ABOX_MCP_TOKEN")
		os.Exit(2)
	}
	if err := sess.SetMCPTokens(ctx, map[string]string{env: tok}); err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println("mcp token set on host broker for", env)
	_, err = sess.Turn(ctx, "List your MCP tools by name.", func(ev abox.Event) {
		if ev.Kind == "text" {
			fmt.Print(ev.Text)
		}
	})
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	fmt.Println()
}