MCPMaster

Enterprise-grade MCP (Model Context Protocol) connection manager for VS Code. Connect GitHub Copilot Chat to MongoDB, Grafana, Confluence, Splunk, and any REST API — with full credential security, audit logging, and workspace trust integration.

Features

• 5 Built-in Providers — MongoDB, Grafana, Confluence Cloud, Splunk, Generic REST
• 21 MCP Tools — query databases, search dashboards, browse Confluence pages, and more — all from Copilot Chat
• Secure Credential Storage — secrets stored in OS keychain via VS Code SecretStorage; never written to disk or logs
• One-Click Copilot Integration — click "Enable in Copilot Chat" and your tools appear instantly
• Multi-Step Wizard — guided provider selection, requirements review, field entry, and summary before saving
• Audit Log — JSONL audit trail of all connection actions (test, enable, disable, delete) with export support
• Workspace Trust — dangerous operations disabled in untrusted workspaces
• Enterprise Architecture — Clean layered design with separation of concerns, input validation, and security hardening

Supported Providers

Security

• Secrets are stored in VS Code SecretStorage (OS keychain) — never in settings, globalState, or logs
• MongoDB connection strings are sanitized — credentials stripped from URLs and injected as environment variables at runtime
• Dangerous MongoDB operators ($where, $function, $accumulator, $merge, $out) are blocked
• Query depth limited to 10 levels; pipeline stages capped at 20; response text truncated at 100KB
• CSP-hardened webview with cryptographic nonce, no inline scripts
• Workspace Trust enforced — test and enable actions disabled in untrusted workspaces
• .vscode/mcp.json auto-added to .gitignore to prevent credential commits
• Audit log records all sensitive operations with timestamps and redacted host info

Authentication

MCPMaster implements a zero-trust credential architecture — secrets are never written to disk, logged, or embedded in configuration files. Every provider uses a distinct authentication flow tailored to its platform.

How Credentials Are Handled

┌──────────────────────────────────────────────────────────────────────┐
│  User enters credentials in the setup wizard                        │
│         │                                                           │
│         ▼                                                           │
│  Secrets → VS Code SecretStorage (OS Keychain)                      │
│         │    macOS Keychain · Windows Credential Locker              │
│         │    GNOME Keyring / KWallet (Linux)                        │
│         │                                                           │
│         ▼  (on "Enable in Copilot Chat")                            │
│  Secrets injected as MCPMASTER_SECRET_* environment variables       │
│  into the MCP server process at launch time (just-in-time)          │
│         │                                                           │
│         ▼                                                           │
│  MCP server reads env vars ONCE at startup, then authenticates      │
│  against the provider API — secrets are never echoed, logged,       │
│  or included in tool responses                                      │
└──────────────────────────────────────────────────────────────────────┘

Key guarantees:

Per-Provider Authentication

MongoDB

How it works: The connection string you provide is sanitized — any embedded user:pass@ is removed. At runtime, MCPMaster reconstructs the authenticated URI by injecting encodeURIComponent(user):encodeURIComponent(pass)@ into the scheme prefix. The MCP server connects using the official MongoDB Node.js driver with a 10-second server selection timeout and automatic idle disconnection after 60 seconds.

Recommended setup:

1. Create a dedicated database user with readOnly role on the required databases
2. Use MongoDB Atlas IP Access List to restrict connections
3. Provide the connection string without credentials — enter username and password in the separate secret fields

Grafana

How it works: MCPMaster authenticates using Grafana's Service Account Token mechanism. Every API request includes an Authorization: Bearer <token> header. The test connection flow verifies both the /api/health endpoint (unauthenticated) and /api/org (authenticated) to confirm the token is valid.

Recommended setup:

1. In Grafana → Administration → Service Accounts, create a new service account
2. Assign the Viewer role (minimum privilege for read-only dashboards and alerts)
3. Generate a token (glsa_...) and paste it into the wizard
4. Scope to specific dashboards/datasources if your Grafana version supports it

Confluence Cloud

How it works: MCPMaster authenticates using Atlassian's Basic Auth scheme: Authorization: Basic base64(email:apiToken). The email is stored as non-secret configuration metadata; only the API token is stored in the OS keychain. The test connection verifies authentication by calling /rest/api/user/current.

Recommended setup:

1. Go to Atlassian API Tokens and create a new token
2. Use the email address associated with the Atlassian account
3. Set a Space Allowlist (optional) to limit which Confluence spaces the tools can access
4. Avoid using OAuth apps with broad org-wide permissions

Splunk

How it works: MCPMaster authenticates using Splunk's Bearer Token auth: Authorization: Bearer <token>. All requests are sent to the Splunk management API (typically port 8089). The test connection verifies by calling /services/server/info?output_mode=json. Search queries use one-shot export mode for immediate results.

Recommended setup:

1. In Splunk → Settings → Tokens, create an authentication token
2. Assign the can_search role with access limited to the required indexes
3. Use the management port (8089), not the web UI port (8000)
4. Set an Index Allowlist (optional) to document which indexes the token can access

Generic REST

How it works: MCPMaster supports three authentication methods for any REST API:

Recommended setup:

1. Prefer Bearer Token or API Key auth over Basic Auth when the API supports it
2. Create a dedicated API key/token with the minimum required scopes
3. Set the Test Path to a lightweight read-only endpoint (e.g., /api/v1/health)

Runtime Security Model

When you click Enable in Copilot Chat, the following happens:

1. Secret retrieval — MCPMaster reads credentials from the OS keychain (just-in-time, not cached)
2. Environment injection — Secrets are passed as MCPMASTER_SECRET_* environment variables to the MCP server process
3. Process isolation — Each connection runs as a separate Node.js process with its own environment
4. No persistence — Environment variables exist only in the server process memory; they are not written to disk
5. Auto-cleanup — When you disable a connection or the extension deactivates, the server process is terminated and all in-memory credentials are discarded

Audit Trail

Every security-sensitive operation is recorded in the audit log:

Audit events never contain credentials, request bodies, response payloads, or full URLs. Only the hostname is recorded (with credentials stripped). Export the audit log at any time from the Audit Log tab in the MCPMaster sidebar.

Requirements

• VS Code 1.101.0 or later
• Node.js 18.x or later (for MCP server process)

Getting Started

1. Install the extension
2. Click the MCPMaster icon in the Activity Bar
3. Click + New Connection and follow the wizard
4. Click Test Connection to verify credentials
5. Click Enable in Copilot Chat — your tools appear in Copilot Chat immediately

Development

npm install
npm run compile
# Press F5 to launch Extension Development Host

Project Structure

MCPMaster/
├── src/
│   ├── extension.ts                    # Entry point
│   ├── models/
│   │   ├── Connection.ts               # Connection types & factory
│   │   └── ProviderRegistry.ts         # Provider field specs & visibility
│   ├── services/
│   │   ├── ConnectionService.ts        # Facade (stores + testing)
│   │   ├── ConnectionTester.ts         # Per-provider test logic
│   │   ├── AuditLogger.ts             # JSONL audit log
│   │   └── McpManager.ts             # MCP server registration
│   ├── storage/
│   │   ├── ConnectionStore.ts          # Non-secret metadata (globalState)
│   │   └── SecretStore.ts             # Secrets (OS keychain)
│   ├── mcp/
│   │   └── mcpServer.ts              # Standalone MCP stdio server (21 tools)
│   └── views/
│       └── ConnectionsViewProvider.ts  # Webview UI (wizard, detail, audit)
├── media/
│   ├── mcpmaster-icon.svg             # Activity Bar icon
│   └── providers/                     # Provider logo SVGs
└── package.json

Publishing

npx vsce package   # produce a .vsix
npx vsce publish   # publish to the Marketplace