​
On the server

  • API keys (clr_<prefix>_<secret>): only a SHA-256 hash is stored. The raw key is shown once, when it’s made.
  • Device codes: hashed too. A device code yields one key at most, minted in the same step that spends the code.
  • Web session cookies: the WorkOS session, sealed with a key only the server has; the server keeps the session id. No passwords anywhere: WorkOS handles sign-in.
  • Browser session tokens (clt_…): HMAC-signed, 1 hour, die with the key, session or membership that minted them.
  • Tokens in URLs are redacted from the server’s access log.

​
On your machine (CLI)

  • npx getclaros saves the key once, in ~/.config/getclaros/config.json ($XDG_CONFIG_HOME): mode 0600, in a 0700 directory.
  • Never in a client config. Project files like .mcp.json are often committed; the guard and the claros bridge read the key from the config file instead.
  • The CLI never prints a key, only its id (clr_<prefix>_…).
  • --key and $CLAROS_KEY override the saved key. Prefer the env var: flags show up in process lists.
  • The guard adds no credentials to the server it wraps; that server’s own env passes through unchanged.

​
Backups

init and undo back up every file they change to ~/.config/getclaros/backups/<time>/ (0600 files, 0700 directory). Those are full copies of your client configs, which can hold other servers’ tokens. Delete the folder once you’re happy.