GLM MCP Wrapper stores your Z.ai API key securely in macOS keychain and never writes credentials to plaintext files.

This system uses ONE Z.ai API key stored in macOS keychain:

Both claude-by-glm and glm-mcp-wrapper use the same API key from keychain.

┌─────────────────────────────────────────────────────────────────────┐
│                        claude-by-glm                                │
│  (fetches z.ai-api-key from keychain → ANTHROPIC_AUTH_TOKEN)       │
└───────────────────────────────┬─────────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│  Claude Code with GLM_MODE=1                                       │
│  • Uses GLM models (glm-4.5-air, glm-4.6, glm-4.7)                 │
│  • Activates MCP wrapper via ~/.claude.json                        │
└───────────────────────────────┬─────────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    glm-mcp-wrapper                                 │
│  (fetches z.ai-api-key from keychain → ZAI_API_KEY)                │
└───────────────────────────────┬─────────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    Z.ai MCP Server                                 │
│  (npx @z_ai/mcp-server)                                            │
└─────────────────────────────────────────────────────────────────────┘

• No plaintext storage: API key never written to files
• Keychain encryption: Key stored encrypted by macOS
• Restrictive permissions: Scripts set to mode 500 (owner read/execute only)
• Input validation: API key format validated before storage
• No -U flag: Keychain ACLs restrict access to specific processes only

1. Lock your keychain when not in use

   security lock-keychain ~/Library/Keychains/login.keychain-db

2. Use strong keychain password

   • Set in: System Settings → Privacy & Security → Keychain
   • Use unique password, not your account password

3. Review keychain access regularly

   # List GLM-related entry
   security find-generic-password -s "z.ai-api-key" -a "$USER" -w

4. Never share your API key

   • Keys are tied to your Z.ai account
   • Sharing may result in account suspension

5. Keep macOS updated for security patches

1. Never hardcode credentials in source code
2. Always validate user input before use
3. Use restrictive file permissions (500 for scripts)
4. Never use -U flag in keychain operations
5. Log security-relevant events for audit trails

When MCP is enabled (GLM_USE_MCP=1), the API key is temporarily exported as an environment variable (ZAI_API_KEY) to pass it to the Z.ai MCP server.

Risks:

• The API key is visible to all child processes during the MCP server's lifetime
• On Linux, the key can be read from /proc/[pid]/environ by processes with the same UID
• The key may appear in process listings with ps eww or similar tools
• Core dumps could contain the key (mitigated by ulimit -c 0)

Mitigations:

• The wrapper minimizes exposure time by immediately execing the MCP server
• Core dumps are prevented via ulimit -c 0
• The key is never logged or written to files

Recommendations:

1. Disable MCP if you don't need MCP tools (GLM_USE_MCP=0)
2. Run on trusted systems only
3. Use a dedicated API key with minimal permissions
4. Consider using alternative credential methods for high-security environments

To report a security vulnerability:

1. Do not create a public GitHub issue
2. Email details to: [your security contact]
3. Include:
   • Vulnerability description
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if known)

We will respond within 48 hours and coordinate disclosure timeline.

This project follows security best practices from:

• OWASP ASVS - Application Security Verification Standard
• CSC - CIS Critical Security Controls
• CWE - Common Weakness Enumeration

MIT License - See LICENSE file for details.