Gestión de secretos y autenticación de MCP

import os
import requests

# Secret injected via environment variable at runtime
# Never hardcode: API_KEY = "sk-abc123"  # DO NOT DO THIS
API_KEY = os.environ["SCAVIO_API_KEY"]

def mcp_search_handler(query: str, platform: str = "google") -> dict:
    """MCP tool handler that reads API key from environment."""
    r = requests.post(
        "https://api.scavio.dev/api/v1/search",
        headers={"x-api-key": API_KEY},
        json={"platform": platform, "query": query},
        timeout=10,
    )
    return r.json()

# For AWS Secrets Manager rotation:
import json
try:
    import boto3
    client = boto3.client("secretsmanager")
    secret = json.loads(client.get_secret_value(SecretId="scavio-api-key")["SecretString"])
    API_KEY = secret["api_key"]
except ImportError:
    pass  # Fall back to env var in non-AWS environments

result = mcp_search_handler("secure mcp deployment patterns")
print(f"Results: {len(result.get("organic", []))}")

const API_KEY = process.env.SCAVIO_API_KEY;
if (!API_KEY) throw new Error("SCAVIO_API_KEY environment variable is required");

async function mcpSearchHandler(query, platform = "google") {
  const res = await fetch("https://api.scavio.dev/api/v1/search", {
    method: "POST",
    headers: { "x-api-key": API_KEY, "content-type": "application/json" },
    body: JSON.stringify({ platform, query }),
  });
  return res.json();
}

// For secret rotation without restart:
async function getRotatedKey() {
  // AWS Secrets Manager, Vault, or any secret store
  // Cache with TTL to avoid per-request lookups
  const cached = globalThis.__scavioKeyCache;
  if (cached && Date.now() - cached.ts < 300000) return cached.key;
  // Fetch fresh key from secret manager here
  const freshKey = process.env.SCAVIO_API_KEY; // placeholder
  globalThis.__scavioKeyCache = { key: freshKey, ts: Date.now() };
  return freshKey;
}

const result = await mcpSearchHandler("secure mcp deployment patterns");
console.log(`Results: ${(result.organic || []).length}`);