Secrets and MCP

Secrets, deliberately boring

Local files and secrets travel once, at create, in the files payload:

• ~/.claude, ~/.codex, tokens (gh auth token, claude setup-token)
• non-ignored untracked repo files, plus ignored files your .pier/include lists

Untracked files that Git does not ignore ship by default. Ignored files ship only when .pier/include lists them; create prints which ignored env files it is not carrying. The VM never holds cloud credentials. On AWS its instance role carries SSM and nothing else. On GCP it runs with no service account at all.

A bake scrubs everything pier pushed before imaging, and every create pushes it fresh.

Private repos

Repo transfer is GitHub-first. Private repos reuse whatever GitHub credential the laptop already has (gh login, git’s https credential helper, or ssh keys through a forwarded agent). pier verifies the fetch works with exactly the auth the session will have before skipping the bundle.

Pushing from a session works anytime with a token, and while attached with ssh keys only (the forwarded agent leaves when you do).

Git identity

Sessions commit as you. The author identity your laptop’s git uses becomes the session’s global git config, fallbacks included (macOS fills a missing user.name from your account’s full name). Portable settings such as pull.rebase and push.autoSetupRemote come along. Credential helpers, includes and signing stay behind, since they name things that exist only on the laptop. With no git identity at all, create stops and says how to set one.

MCP servers, agents, skills

MCP servers travel with their config, including auth when it’s static (env vars, API-key headers). OAuth-backed remotes keep rotating tokens in the OS keychain and can’t be copied (two holders of one refresh token revoke each other), so they log in once per session, from inside it, the normal way (for example claude’s /mcp). While you’re attached, the session uses your browser:

• anything in the session that opens a URL (an agent’s OAuth login, gh auth login, “open in browser”) opens it in your laptop’s browser
• ports the session listens on (an OAuth callback, a dev server) are reachable at the same port on your laptop

That makes every in-session browser login work, for any agent or CLI. The token lands on the session’s disk and survives parking. Where a provider offers a personal API key, declaring the server with it skips the login entirely: it travels into every session.

Headless Chromium ships in the default image, so browser MCPs and skills (screenshots, web automation) work out of the box.