Repository navigation
[FEATURE]: {cmd:} config placeholder for credential helpers #12710
Description
Feature hasn't been suggested before.
- I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
Config placeholder for credential helpers
Problem Im soving
Currently, config files support {env:VAR} and {file:path} placeholders for injecting values. However, there's no way to securely fetch credentials from credential managers like macOS Keychain, 1Password,
pass, or custom credential helpers (like git credential helpers).
Users who want to configure MCP server authentication must either:
- Hardcode tokens in config files (insecure)
- Store tokens in environment variables (requires manual setup)
- Store tokens in plain text files (insecure)
Solution
A {cmd:command} placeholder that executes a shell command and uses its stdout (trimmed) as the value. This enables integration with any credential manager or helper that can output secrets to stdout.
Use Cases
macOS Keychain:
Authorization: Bearer {cmd:security find-generic-password -s mcp-token -w}
1Password CLI:
Authorization: Bearer {cmd:op read op://vault/mcp-api/token}
pass (password-store):
Authorization: Bearer {cmd:pass show api/token}
Custom credential helper (git-style host:token format):
Authorization: Bearer {cmd:grep '^api.example.com:' ~/.credentials | cut -d: -f2}
Encrypted secrets:
Authorization: Bearer {cmd:openssl enc -aes-256-cbc -d -a -pass pass:$KEY -pbkdf2 -in secret.enc}
Example
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"internal-api": {
"type": "remote",
"url": "https://api.internal.example.com/mcp",
"headers": {
"Authorization": "Bearer {cmd:security find-generic-password -s mcp-token -w}"
}
}
}
}I already have working implementation, if this is accepted I can open a PR.
Activity
github-actions commentedon Feb 8, 2026
This issue might be a duplicate of existing issues. Please check:
{cmd:}placeholder enables integration with CLI tools that keyrings alone don't coverFeel free to ignore if none of these address your specific case.
malikwirin commentedon Apr 9, 2026
How do the
{file:path}placeholders work?kfox1111 commentedon Jun 5, 2026
Would love to be able to use this. Static credentials are problematic and it would be great to solve it by plugging in one of our existing dynamic identity generators such as spire or k8s projected service account tokens.
laiweihwa commentedon Jun 12, 2026
What is the main blocker for this?
tthoma24 commentedon Aug 3, 2026
+1 would use this. Not sure why the PR was just auto closed and never reviewed.
tkoop commentedon Sep 26, 2026
This is a good idea. We should do this. I would up-vote this if I could.
neriousy commentedon Oct 1, 2026
Closing as a duplicate of #7487, which tracks running a command in config variable substitution (for example to fetch credentials from a helper). Please add your use case and 👍 there.