Skip the install. Get this working in under 2 minutes.
Start a free trial on cloud.anythingmcp.com, add the Doppler in one click, then point your AI client (Claude, ChatGPT, Copilot or Cursor) at the generated MCP endpoint. No Docker, no git clone, zero engineering experience required.
Summary
Doppler secrets manager from any AI agent: projects, environments and configs, secret names and values (read, update, download), config change logs and rollback, the workplace activity log, members, groups, service accounts, integrations and service tokens. Three tools return secret values in clear text.
Try asking
Example prompts for Doppler
Click any prompt to copy it. Paste into Claude, ChatGPT, Cursor, Gemini, Copilot or OpenClaw to run it against this connector.
Claude is AI and can make mistakes. Please double-check responses.
💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Doppler, paste your credentials, mint an MCP API key and you're done. No Docker, no
git clone, no local server.
Doppler + Microsoft Copilot
Doppler secrets manager from any AI agent: projects, environments and configs, secret names and values (read, update, download), config change logs and rollback, the workplace activity log, members, groups, service accounts, integrations and service tokens. Three tools return secret values in clear text.
Prerequisites
See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:
DOPPLER_TOKEN
Step 1 — Get credentials
Setting up takes about 2 minutes. You need a Doppler account and a token.
Secrets are visible to the AI. doppler_list_secrets, doppler_get_secret and doppler_download_secrets return secret values in clear text: they enter the conversation, the AI provider's context and your client's chat history. Masked and restricted visibility only hide values in the Doppler dashboard; the API returns them to any token with read access. To see what a config holds, the AI uses doppler_list_secret_names, reads values only when you ask for them and does not repeat a value unless asked. If the AI should only see names and metadata, a workspace admin switches those three tools off.
- Pick a token at https://dashboard.doppler.com:
- Service account token (
dp.sa., Team and Enterprise plans): Team, Service Accounts, create one with a workplace role and project access limited to what the AI needs, then create an API token. The best choice. - Service token (
dp.st.): in a project open a config, then Access, Generate. Choose read access unless the AI should write. It reaches only that one config; workplace, projects, activity log and integrations answer 403. - Personal token (
dp.pt.): your account settings, Tokens. It can do everything you can, in every project.
- Service account token (
- Paste the token into
DOPPLER_TOKENas Doppler shows it, withoutBearerand without spaces. It is sent asAuthorization: Bearer <token>. - Run
doppler_get_me: it shows the token type and the workplace.
Structure and people: doppler_get_workplace, doppler_list_workplace_users, doppler_list_groups and doppler_list_service_accounts (metadata only, never tokens); doppler_list_projects, doppler_get_project, doppler_list_project_members, doppler_list_environments, doppler_get_environment, doppler_list_configs and doppler_get_config. None of these return secret values.
Secrets: doppler_list_secret_names first, it returns names without any value. Values only on request: doppler_get_secret for one, doppler_list_secrets for several (narrowed with secrets), doppler_download_secrets for a whole config as JSON, .env, YAML, Docker or .NET file.
Changes: doppler_update_secrets creates or overwrites values; secrets left out stay as they are. doppler_update_secret_note sets a note that applies to that secret name in every environment of the project. doppler_create_project (Doppler adds dev, stg and prd), doppler_update_project, doppler_create_environment, doppler_create_config (an empty branch config) and doppler_clone_config (a copy with secrets) shape the structure. The values you hand to doppler_update_secrets pass through the conversation as well. The AI confirms names, values and the config with you before writing, above all for prd configs.
History and audit: doppler_list_config_logs and doppler_get_config_log show what changed in a config, with the secret names added, changed and removed but without values. doppler_rollback_config_log restores the state before a change; the rollback is a new log entry itself, so it can be undone the same way. doppler_list_activity_logs and doppler_get_activity_log are the workplace audit trail. doppler_list_integrations and doppler_get_integration show syncs to AWS, GitHub, Vercel, Kubernetes and others; doppler_list_service_tokens lists a config's service tokens without their values.
Switched off at install: doppler_delete_secret. Applications reading the config lose the value at their next fetch and the deletion cannot be undone, so a workspace admin turns it on when the team needs it.
Identifiers: project is the project slug, environment the environment slug (dev, stg, prd), config the config name: a root config has the environment slug as name, a branch config starts with it, for example dev_feature_x. Secret names are case-sensitive and upper case by convention.
Data formats: secret entries carry raw (as typed, with ${OTHER} references) and computed (references resolved). doppler_download_secrets with format: json returns a flat NAME to value object. Times are ISO 8601 in UTC. Answers carry success: true; failures carry messages.
Paging: list tools take page (from 1) and per_page (default 20). The AI asks for the next page while a full page comes back.
Limits: per minute, the Developer plan allows 240 reads, 120 secret reads and 60 writes; Team 480, 240 and 120; Enterprise 480, 480 and 240. Over the limit Doppler answers 429.
Common errors: 401 means a wrong, expired or revoked token, 403 a token without access to that project, config or workplace endpoint (a service token reaches only its config), 404 an unknown project, config, secret or log id, 400 an invalid name or body, 429 the rate limit.
The connector never returns the values of service tokens or service account tokens, does not delete projects, environments or configs and does not change integrations or access rights.
Step 2 — Install the adapter
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
Step 3 — Add the connector in Microsoft Copilot
Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (
https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide showsYOUR_SERVER_ID.
Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.
- In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
- Enter a Server name (for example
AnythingMCP), a Server description that says what the connector does, and the Server URLhttps://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server. - Under authentication, choose API key, set Type to Header and the header name to
X-API-Key, then select Create. - In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
- Try it in the agent's Test pane: ask for something that needs the
Dopplertools. - Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.
Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.
Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.
Available tools
| Tool | What it does |
|---|---|
doppler_get_me | Who the token belongs to: token type (personal, service, service_account, cli), name, token preview, creation and last-seen time, and the… |
doppler_get_workplace | The workplace (organisation) the token belongs to: slug, name, billing and security email |
doppler_list_workplace_users | Members of the workplace with their user id, email, name, workplace role and access level. 20 per page; filter by email to find one person |
doppler_list_groups | Groups of the workplace with their slug, name, default project role and members |
doppler_list_service_accounts | Service accounts of the workplace: slug, name, workplace role and creation time |
doppler_list_projects | Projects the token can see: slug (used as project everywhere else), name, description and creation time |
doppler_get_project | One project by its slug: slug, name, description and creation time, without its configs or secrets |
doppler_list_project_members | Who has access to a project: members of type workplace_user, group, service_account or invite, with their project role and the environments… |
doppler_list_environments | Environments of a project (e.g. dev, stg, prd): slug, name, whether personal configs are on, and creation time |
doppler_get_environment | One environment of a project by its slug: name, slug, whether personal configs are on, and creation time |
doppler_list_configs | Configs of a project, optionally of one environment: name, environment, whether it is a root config, locked, inheritable, and when its… |
doppler_get_config | One config: name, environment, root or branch, locked, inheritable, the configs it inherits from, creation time and last fetch |
doppler_list_secret_names | The NAMES of the secrets in a config, without any value |
doppler_list_secrets | READS SECRET VALUES: every secret of a config (or the ones named in secrets) with its raw value, computed value (references resolved)… |
doppler_get_secret | READS A SECRET VALUE: one secret of a config with its raw value, computed value, note, visibility and value type |
doppler_download_secrets | READS SECRET VALUES: the computed values of a config as one file, in JSON (default, a NAME to value object), .env, YAML, Docker or .NET… |
doppler_list_config_logs | Change history of a config, newest first: log id, text, who made the change, when, and whether it was a rollback |
doppler_get_config_log | One entry of a config's change history, with the list of secret names added, changed and removed |
doppler_list_activity_logs | Workplace audit trail, newest first: who did what to which project, environment or config, and when |
doppler_get_activity_log | One workplace activity log entry by id: text, user, project, environment, config and time of the action |
doppler_list_integrations | Integrations of the workplace (AWS Secrets Manager, GitHub, Vercel, Kubernetes and others): slug, name, type, kind and whether it is… |
doppler_get_integration | One integration with its syncs (which config is pushed where) |
doppler_list_service_tokens | Service tokens of a config: name, slug, access (read or read/write), creation and expiry time |
doppler_create_project | Create a project |
doppler_update_project | Rename a project or change its description |
doppler_create_environment | Add an environment to a project, e.g. qa |
doppler_create_config | Create an empty branch config in an environment |
doppler_clone_config | Create a branch config as a copy of another config, secrets included |
doppler_update_secrets | Create or overwrite secrets in a config. secrets maps each NAME to its new value as a string; secrets left out stay as they are |
doppler_update_secret_note | Set the note on a secret |
doppler_rollback_config_log | Restore a config's secrets to the state before the change of one log entry |
doppler_delete_secret | Delete one secret from a config |
Example prompts
- "Which secrets does the prd config of the backend project contain? Names only, no values."
- "What changed in the stg config of backend this week, and who made the change?"
- "Set FEATURE_NEW_CHECKOUT to true in the dev config of backend. Show me the change before saving."
- "Roll back the last change to the prd config of backend. Show me that log entry first."
- "Which integrations sync our configs to AWS or Vercel, and which configs do they push?"
FAQ
Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.
What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.
The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.
Next steps
- Connector landing page
- Connect to Claude
- Connect to ChatGPT
- Connect to Cursor
- Connect to Gemini
- Connect to Meta Muse
Was this guide helpful?