Bring Mattermost into your coding agent.

Install secret-tool, then store the PAT in the logged-in user's Secret Service collection.

sudo apt install libsecret-tools
secret-tool store \
  --label='Mattermost MCP PAT' \
  service mattermost-mcp \
  account "$USER"

Recommended launcher: add this function once to ~/.bashrc or ~/.zshrc. It keeps the usual client commands while loading the PAT automatically:

_mattermost_mcp_launch() {
  local client="$1"
  shift
  local token
  token="$(secret-tool lookup service mattermost-mcp account "$USER")"
  if [ -z "$token" ]; then
    echo 'Mattermost MCP PAT was not found.' >&2
    return 1
  fi
  MATTERMOST_PAT="$token" command "$client" "$@"
}

codex()  { _mattermost_mcp_launch codex "$@"; }
claude() { _mattermost_mcp_launch claude "$@"; }
cursor() { _mattermost_mcp_launch cursor "$@"; }

If you choose this launcher, reload the profile once, then type codex, claude, or cursor normally:

source ~/.bashrc  # Use source ~/.zshrc if you use zsh.

Store the PAT in your login Keychain. Because -w has no value after it, macOS asks for the token interactively and it never enters your shell history:

security add-generic-password -a "$USER" -s mattermost-mcp -w

Recommended launcher: add this function once to ~/.zshrc. It contains no secret and keeps the usual client commands while loading the PAT automatically:

_mattermost_mcp_launch() {
  local client="$1"
  shift
  local token
  token="$(security find-generic-password \
    -a "$USER" -s mattermost-mcp -w)" || return 1
  MATTERMOST_PAT="$token" command "$client" "$@"
}

codex()  { _mattermost_mcp_launch codex "$@"; }
claude() { _mattermost_mcp_launch claude "$@"; }
cursor() { _mattermost_mcp_launch cursor "$@"; }

If you choose this launcher, reload the profile once, then type codex, claude, or cursor normally:

source ~/.zshrc

Do not add a PAT value or export MATTERMOST_PAT=... to ~/.zshrc. Fully quit an already-running GUI client before starting it through the launcher.

Install Microsoft's SecretManagement modules for your user, register the vault once, and let Set-Secret prompt securely.

Install-Module Microsoft.PowerShell.SecretManagement `
  -Repository PSGallery -Scope CurrentUser
Install-Module Microsoft.PowerShell.SecretStore `
  -Repository PSGallery -Scope CurrentUser
Register-SecretVault -Name MattermostMcp `
  -ModuleName Microsoft.PowerShell.SecretStore
Set-Secret -Name MattermostPat -Vault MattermostMcp

Recommended launcher: add these functions once to your PowerShell profile (notepad $PROFILE). They contain no secret and keep the usual client commands:

function Invoke-MattermostMcpClient {
  param(
    [Parameter(Mandatory = $true)][string] $Name,
    [object[]] $ClientArgs
  )

  $client = Get-Command $Name -CommandType Application,ExternalScript |
    Select-Object -First 1
  if (-not $client) { throw "Client '$Name' was not found." }

  $env:MATTERMOST_PAT = Get-Secret -Name MattermostPat -Vault MattermostMcp -AsPlainText
  try { & $client.Source @ClientArgs }
  finally {
    Remove-Item Env:MATTERMOST_PAT -ErrorAction SilentlyContinue
  }
}

function codex  { Invoke-MattermostMcpClient -Name 'codex'  -ClientArgs $args }
function claude { Invoke-MattermostMcpClient -Name 'claude' -ClientArgs $args }
function cursor { Invoke-MattermostMcpClient -Name 'cursor' -ClientArgs $args }

If you choose this launcher, reload the profile once, then type codex, claude, or cursor normally:

. $PROFILE