Skip to content

docs: add security section and keychain prompt explanation#72

Merged
ldraney merged 1 commit intomainfrom
69-security-docs
Jan 28, 2026
Merged

docs: add security section and keychain prompt explanation#72
ldraney merged 1 commit intomainfrom
69-security-docs

Conversation

@ldraney
Copy link
Owner

@ldraney ldraney commented Jan 28, 2026

Summary

  • Explains the macOS Keychain prompt ("node wants to use your confidential information stored in 'github-mcp'") so users know it's expected and safe
  • Adds a dedicated Security section to the guide covering:
    • OS Keychain storage (encrypted, never plaintext)
    • OAuth flow (no PATs to manage)
    • Client secret stays server-side (Fly.io, never in npm/mcpb)
    • No open ports (temporary localhost callback + smee.io SSE)
  • Updates auth steps to reflect actual browser redirect flow (not device code polling)
  • Fixes architecture.html reference from keytar → @napi-rs/keyring

Test plan

  • Review guide.html Security section renders correctly
  • Verify keychain prompt card is clear and reassuring
  • Confirm architecture.html keytar reference is updated

Refs #69

🤖 Generated with Claude Code

- Add macOS Keychain prompt explanation to guide (the "node wants to
  use your confidential information" dialog)
- Add dedicated Security section covering keychain storage, OAuth
  flow, server-side client secret, and no open ports
- Update auth steps to reflect actual browser redirect flow
- Fix architecture.html: keytar → @napi-rs/keyring

Refs #69

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@ldraney ldraney merged commit 536087d into main Jan 28, 2026
1 check passed
@ldraney ldraney deleted the 69-security-docs branch January 28, 2026 19:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant