Skip to content
Doppler

DopplerMCP Server

by Doppler
Released
v1.0.5
Apache-2.0
Repository Docs npm
Developer ToolsCloud & Infrastructure

Summary

Doppler's official MCP server — let an agent list projects, read and write secrets, manage configs and review activity logs, scoped by the token you give it.

Features

  • List projects, configs and secrets, and read values or download a whole config
  • Create and update secrets and manage environments and configs
  • Read the Doppler activity log for an audit of recent changes
  • --read-only drops every write tool for a safe browse-only setup
  • --project and --config pin the agent to one project/config pair
  • Interactive `login` for humans, DOPPLER_TOKEN service tokens for CI

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it.
  3. Restart the agent — the "Doppler" tools will be available.
{
  "mcpServers": {
    "doppler-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@dopplerhq/mcp-server"
      ]
    }
  }
}

Description

Doppler is a secrets manager: one place to hold API keys, database URLs and other credentials, and sync them into every environment that needs them. The official Doppler MCP server (@dopplerhq/mcp-server, Apache-2.0) puts that store behind an agent's tool calls, so a coding assistant can answer "which config is this service reading?" or add a new secret to a staging config without you leaving the editor.

What it exposes. Listing projects, configs and secrets; reading secret values and downloading a whole config; creating and updating secrets; managing environments and configs; and reading the activity log. Which of those an agent can actually reach depends on two things you control: the --read-only flag, which drops every write tool, and the scope of the token itself.

Authentication. Run npx @dopplerhq/mcp-server login once for an interactive browser login, or pass a DOPPLER_TOKEN service token in the client config for CI and shared machines. Doppler is explicit that the token is where real access control lives — --read-only hides the write tools but does not stop a determined agent from finding another route, so scope the token to exactly the projects and configs you intend to expose.

Worth knowing before you wire it into production. Doppler ships this as experimental, intended for development, testing and evaluation. Model output is non-deterministic, so treat anything the agent does against real secrets as something to review, not to trust blindly. --project and --config override the auto-detected pair when you want the agent pinned to one place.

Related MCP Servers

MCP: Cloudsmith MCP

by Cloudsmith

Cloudsmith's official MCP server, built into its CLI: manage artifact repositories, packages and policies through an agent, with write operations off by default.

Developer Tools
Browse all MCP servers →