MCP configuration without plaintext secrets
Separate ordinary configuration from encrypted envelopes and export environment references to every supported client.
An MCP configuration often combines harmless values with credentials. Treating the entire object as one blob makes masking, rotation, and safe export harder.
Potion stores normal fields and secret envelopes separately. Every secret uses envelope encryption, and the UI can replace or delete a value without reading it back.
Portable exports
Generated client files contain environment references. That keeps one safe configuration model portable across Clawk, Claude Code, Codex, OpenCode, Cursor, and generic JSON.