Verified

Unix Pass MCP Server

Access Unix pass stores via MCP with strict input validation and read-only defaults.

Data last scanned today · Reviewed today

34 2 dangerous tools24 tools★ 1PythonMIT

Overview

This server bridges the Unix 'pass' password manager with the Model Context Protocol, allowing AI assistants to interact with encrypted GPG-stored credentials safely. It includes a typed MCP interface that supports reading, TOTP/OTP generation, and GPG-integrated operations while preventing shell escapes and clipboard exposure. Designed with a 'read-only by default' security model, the server keeps sensitive write and administration actions behind explicit environment variable flags. It utilizes strict input validation to prevent path traversal and includes an audit log for all operations performed.

Our verdict

With a security score of 24/100, this tool is categorized as high-risk. While the project implements strict input validation and a read-only default to mitigate common vulnerabilities, it is a community-maintained project that has not yet undergone independent editorial review. Users should exercise caution; it is best suited for experienced developers who can verify the implementation and manage environment-based security permissions.

Strict input validation prevents shell and path traversal risks
Read-only by default with environment-gated mutation capabilities
Features 346 unit tests and 45 GPG integration tests
Zero direct dependencies reduce the overall supply-chain surface

High-risk security score requires user diligence
Not an official vendor-maintained project
One-person contributor team increases bus-factor risk

Tools

Tool	Description	Risk
store_info	Inspect the store: path, recipients per subdir, git/agent/pinentry/signing status, warnings. No decryption.	low
list	List pass-names (optionally scoped to a subfolder). No decryption.	low
find	Substring search over leaf names. No decryption.	low
show	Decrypt and return one line of an entry (default = line 1 = password). Marked sensitive.	low
show_field	Decrypt and return one named metadata field (`URL`, `Username`, `otpauth`, …). Case-insensitive.	low
show_metadata	Decrypt and return only the entry shape (which fields exist, their values, line count). Password value is never returned.	low
unlock_agent	Pop a desktop password dialog (zenity/kdialog) and warm gpg-agent's cache via loopback pinentry.	low
grep	Search inside the decrypted body of every entry.	low
otp	Compute the current TOTP code from an entry's `otpauth://` line.	low
otp_uri	Return the raw `otpauth://` URI (contains the secret).	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Is the server read-only by default?

Yes, the server is read-only by default to prevent unauthorized changes. Mutations like write operations or key administration must be explicitly enabled using the PASS_MCP_ALLOW_WRITES environment variable.

›What happens if I try to use the server without a configured GPG agent?

The server checks for a reachable gpg-agent at startup by running gpg-connect-agent. It will refuse to decrypt any information if the agent is not reachable.

›How do I provide passphrases for decryption?

The server cannot handle interactive passphrase prompts directly. You must use a GUI pinentry program, the unlock_agent tool, or pre-warm the agent by running a pass command in a terminal before using the MCP server.

›Are there limitations on which password store paths I can modify?

Yes, you can restrict write operations to specific subdirectories using the PASS_MCP_ALLOWED_PATHS environment variable when enabling mutations.

›What are the core system requirements for running this server?

You must have Python 3.11 or higher, the pass binary, GnuPG version 2.2 or higher, and a GPG key with its trust level set to ultimate installed on your system.