Secrets and MCP

Secrets, deliberately boring

Secrets travel once, at create, as an explicit manifest:

• ~/.claude, ~/.codex, tokens (gh auth token, claude setup-token)
• the repo files your .pier-include lists

Nothing loose ships by default. The create prints which env files it is not carrying. The VM never holds cloud credentials, its instance role carries SSM and nothing else.

Private repos

Repo transfer is GitHub-first. Private repos reuse whatever GitHub credential the laptop already has (gh login, git’s https credential helper, or ssh keys through a forwarded agent). pier verifies the fetch works with exactly the auth the session will have before skipping the bundle.

Pushing from a session works anytime with a token, and while attached with ssh keys only (the forwarded agent leaves when you do).

MCP servers, agents, skills

MCP servers travel with their config, including auth when it’s static (env vars, API-key headers). OAuth-backed remotes keep rotating tokens in the OS keychain and can’t be copied, so they need one browser approval per session:

pier mcp login <session>    # sweeps whatever still needs auth

Headless Chromium ships in the default image, so browser MCPs and skills (screenshots, web automation) work out of the box.