Added keyring support for secrets

README.md

@@ -40,6 +40,25 @@ You can run the MCP server directly with npx:
 npx @doist/todoist-ai
 ```
 
+### Secure Credential Storage
+
+For enhanced security, you can store your Todoist API key in your system's keychain instead of using environment variables:
+
+```bash
+# Store API key securely in keychain (prompts for hidden input)
+npx todoist-ai-setup-keychain
+
+# Run - automatically uses keychain when no TODOIST_API_KEY env var is set
+npx @doist/todoist-ai
+```
+
+This stores your API key securely in:
+- **macOS**: Keychain Access
+- **Windows**: Windows Credential Manager  
+- **Linux**: Secret Service (GNOME Keyring, KWallet, etc.)
+
+The base URL can still be configured via `TODOIST_BASE_URL` environment variable if needed.
+
 For more details on setting up and using the MCP server, including creating custom servers, see [docs/mcp-server.md](docs/mcp-server.md).
 
 ## Features

docs/dev-setup.md

@@ -6,7 +6,28 @@
 npm run setup
 ```
 
-## 2. Configure environment variables
+## 2. Configure credentials
+
+You have two options for configuring your Todoist credentials:
+
+### Option A: Using Keychain (Recommended)
+
+Store your API key securely in the user keychain:
+
+```sh
+npm run setup-keychain
+```
+
+This will securely prompt you for your API key (hidden input with asterisks) and store it in your user's keychain (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux).
+
+The server will automatically use the keychain API key when no `TODOIST_API_KEY` environment variable is set. You can still set the base URL if needed:
+
+```env
+# Optional: Set custom base URL
+TODOIST_BASE_URL=https://local.todoist.com/rest/v2
+```
+
+### Option B: Using Environment Variables
 
 Update the `.env` file with your Todoist token:
 

docs/mcp-server.md

@@ -10,7 +10,7 @@ The easiest way to use this MCP server is with npx:
 npx @doist/todoist-ai
 ```
 
-You'll need to set your Todoist API key as an environment variable `TODOIST_API_KEY`.
+You'll need to set your Todoist API key as an environment variable `TODOIST_API_KEY`, or store it securely in keychain (automatically used when no environment variable is set).
 
 ## Local Development Setup
 
@@ -51,6 +51,7 @@ Then, proceed depending on the MCP protocol transport you'll use.
 
 Add this section to your `mcp.json` config in Claude, Cursor, etc.:
 
+#### Using Environment Variables
 ```json
 {
     "mcpServers": {
@@ -66,10 +67,30 @@ Add this section to your `mcp.json` config in Claude, Cursor, etc.:
 }
 ```
 
+#### Using Keychain (Recommended)
+First, store your API key securely:
+```bash
+npx todoist-ai-setup-keychain
+```
+
+Then configure without any environment variables (automatically uses keychain):
+```json
+{
+    "mcpServers": {
+        "todoist-ai": {
+            "type": "stdio",
+            "command": "npx",
+            "args": ["@doist/todoist-ai"]
+        }
+    }
+}
+```
+
 ### Using local installation
 
 Add this `todoist-ai-tools` section to your `mcp.json` config in Cursor, Claude, Raycast, etc.
 
+#### Using Environment Variables
 ```json
 {
     "mcpServers": {
@@ -87,9 +108,24 @@ Add this `todoist-ai-tools` section to your `mcp.json` config in Cursor, Claude,
 }
 ```
 
-Update the configuration above as follows
+#### Using Keychain (Recommended)
+```json
+{
+    "mcpServers": {
+        "todoist-ai-tools": {
+            "type": "stdio",
+            "command": "node",
+            "args": [
+                "/Users/<your_user_name>/code/todoist-ai-tools/dist/main.js"
+            ]
+        }
+    }
+}
+```
 
-- Replace `TODOIST_API_KEY` with your Todoist API token.
+Update the configuration above as follows:
+- For environment variable setup: Replace `TODOIST_API_KEY` with your Todoist API token.
+- For keychain setup: Run `npm run setup-keychain` first to store your API key securely.
 - Replace the path in the `args` array with the correct path to where you cloned the repository
 
 > [!NOTE]