Skip to main content
The keys that your MCP servers and your [spend] command need come from the daemon’s environment. piloop does not know any secrets manager. You have two options:
  • Start piloop serve with the keys set in its environment.
  • Set PILOOP_SECRETS_COMMAND to a shell command that prints the keys.

​
PILOOP_SECRETS_COMMAND

The command prints one NAME=value line for each key. The daemon runs it with sh -c when it starts, and again on each piloop restart and piloop upgrade. So a rotated key is read at the next restart. A key that the command no longer prints stays set until the service manager restarts the daemon.
  • The values go into the daemon’s environment only. piloop never writes them to a file, the database or a log.
  • The start fails when the command fails, runs longer than 60 seconds, prints nothing, or prints a line that is not NAME=value, has an empty value or has whitespace in the value. The error names the line or the variable, never the value.
  • The command’s stderr goes where the daemon’s stderr goes.
Set it before you create the service unit, and the unit includes it:
piloop doctor says where the secrets come from. It runs the command, lists the names that it prints, and names every variable that an MCP server of a project needs and that is still missing.

​
Examples

A file:
AWS Secrets Manager, with one secret for each key:
1Password, with op read: