Team Config Sync In development

Team Sync

Shared config, private credentials

Let your whole team share one set of AI CLI and MCP configs, while sensitive credentials stay separate per person and never enter Git.

Mode Overview

Config Distribution Model

graph LR; G[Team Git: non-sensitive config] --> S[Switch: local UI]; V[Vault / OS Keyring: sensitive credentials] --> S; S --> G; S --> V

Git Repository

Check in the config skeleton: server lists, tool definitions, preset prompts.

Vault / OS Keyring

Stores sensitive items like API keys and GitHub tokens — never enters Git.

Git Sync

1. Bind the team config repository for the first time:

   lurus-switch team init git@github.com:your-org/ai-config.git

2. Day-to-day pull and push:

   lurus-switch team pull
   lurus-switch team push

   team pull fetches what the team shares:

   • mcp.yaml (MCP Server list)
   • cli-configs/*.yaml (the shareable parts of the 5 CLIs)
   • prompts/ (prompt templates)

Vault Bridging

# ~/.lurus-switch/vault.yaml
provider: hashicorp-vault
address: https://vault.internal.example.com
auth:
  method: token
  token_env: VAULT_TOKEN

Reference it in mcp.yaml:

servers:
  github:
    env:
      GITHUB_TOKEN: vault://secret/ai/github#token

Plaintext never hits disk

When Switch starts an MCP Server, it pulls values from Vault dynamically, so plaintext credentials never hit disk.

Supported providers:

HashiCorp Vault

Centralized secret management service

macOS Keychain

System-level credential store

Windows Credential Manager

System-level credential store

Linux Secret Service

libsecret backend

Diff Audit

lurus-switch team diff

Shows the config differences between your local setup and the team remote (excluding sensitive items).

Rollback

lurus-switch team rollback <commit-sha>

Roll local config back to any historical version in Git.

Next Steps

Next steps

Back to the user guideMCP ServersCost Monitoring