What is a secret reference?

Instead of pasting an API key or token directly into a client’s MCP config, a secret reference names where the value lives — an environment variable, a dotenv file, or a secret manager such as 1Password or Infisical. The config carries only the reference.

mcpfold resolves each reference at fold time, from your environment or secret manager, so nothing sensitive is written to a client config or committed to git. Some clients can even receive the reference natively via their own input mechanism.

This keeps credentials out of the files that are most likely to be shared, synced, or accidentally checked in.