This page covers secure usage practices for seq-mcp.

• Use least-privilege Seq API keys.
• Keep credentials out of source control.
• Prefer HTTPS for non-local Seq endpoints.
• Grant permissions only for the tools/routes your client actually calls.

Required variables:

• SEQ_URL
• SEQ_API_KEY

Do not hardcode keys in source files.

Prefer:

• Environment variables.
• Secret stores.
• Local .env files that are excluded from commits.

References:

• API keys and permission model: https://docs.datalust.co/docs/api-keys
• HTTP API usage guide: https://docs.datalust.co/docs/using-the-http-api
• Endpoint/permission table: https://docs.datalust.co/docs/server-http-api

Typical permission usage:

• Read: required for starter query and retrieval workflows.
• Ingest: only if using ingestion routes.
• Write: only for mutation routes.
• Project, Organization, System: only for admin routes that explicitly need them.

• Rotate API keys regularly.
• Remove unused keys.
• Review tool usage and permission scope periodically.
• Use dedicated keys per environment when possible.

• Local development may use http://localhost.
• For any remote endpoint, use https:// and valid TLS configuration.

• Reusing an over-privileged admin key for all clients.
• Passing secrets in logs, screenshots, or issue comments.
• Assuming starter-tool permissions are enough for broad API tools.

See also: Tools Reference and Troubleshooting.