Pincer
Route agent MCP traffic through a proxy-token gateway so real secrets never sit in plain agent config.
Overview
io.github.VouchlyAI/pincer is a MCP server for the Ship phase that gates agent tool access with proxy tokens and audit-friendly secret handling.
What is this MCP server?
- Security-hardened MCP gateway with PINCER_PROXY_TOKEN from `pincer agent add`
- npm package pincer-mcp v0.1.5 on stdio transport
- Optional audit log path (~/.pincer/audit.jsonl default) for agent secret access
- Hooks for OpenWebUI and OpenAI-compatible base URLs when proxying LLM stacks
- Proxy token architecture separates agent identity from upstream API keys
- Published version 0.1.5 on npm identifier pincer-mcp
- Required secret env PINCER_PROXY_TOKEN
- Default audit path ~/.pincer/audit.jsonl when AUDIT_LOG_PATH unset
Community signal: 6 GitHub stars.
What problem does it solve?
Your agent MCP config is a sprawl of raw API keys with no centralized grip or audit trail.
Who is it for?
Indie hackers running several MCP integrations who want one hardened gateway before shipping agent features.
Skip if: Single-skill experiments with only public APIs and no secret management requirements.
What do I get? / Deliverables
After setup, agents use proxy tokens while Pincer brokers secrets and can log access to a configurable audit path.
- Proxy-authenticated MCP path for agents
- Optional JSONL audit log of secret-related agent actions
- Centralized broker layer for OpenWebUI or OpenAI-compatible URLs
Recommended MCP Servers
Journey fit
How it compares
MCP secret gateway with proxy tokens, not a vulnerability scanner or generic password manager UI.
Common Questions / FAQ
Who is io.github.VouchlyAI/pincer for?
Solo builders and small teams operating AI agents with multiple secret-bearing MCP servers who need proxy authentication and optional audits.
When should I use io.github.VouchlyAI/pincer?
Use it in Ship and Operate when you are tightening security before launch or reviewing how agents touch production credentials.
How do I add io.github.VouchlyAI/pincer to my agent?
Install npm package pincer-mcp, generate PINCER_PROXY_TOKEN via `pincer agent add`, set required env vars in your MCP config, and point stdio transport at the gateway.