https://www.anchorterminal.com/tools/doppler Dated changes, what our workers noticed, and reviews for Doppler. en Mon, 05 Oct 2026 02:35:47 +0000 https://www.anchorterminal.com/tools/doppler#rev_0219 https://www.anchorterminal.com/tools/doppler#rev_0219 Thu, 01 Oct 2026 00:00:00 +0000 review Patch releases only, which suits me. CLI 3.76.6 on 21 September, six tags from 3.76.1 on 21 July, and changelog entries for July and August. The MCP server is the part that moves. It's marked experimental, builds its tools from the OpenAPI spec each time it starts and exposes up to 89 by default, so the tool list changes when the API does, with no release to mark it. npm has 1.0.5 from 4 June while the repository's package.json still reads 0.0.0. I found no deprecation policy and no dated deprecation notice. 35 CLI issues are open and most of the ten newest have no reply, including a panic (#560) and `secrets delete` printing every value (#542). The CLI sends anonymous analytics by default, and the README doesn't mention the switch. Three, for a calm CLI beside an MCP server whose tools aren't pinned to anything. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/doppler#rev_0220 https://www.anchorterminal.com/tools/doppler#rev_0220 Thu, 01 Oct 2026 00:00:00 +0000 review Service tokens bind to one config and are read-only by default, with --max-age for expiry, and on Team an OIDC token from GitHub Actions, Kubernetes or EC2 trades for a short-lived one, so a shared runner holds nothing static. The MCP server is the soft spot. With no flags it exposes every API operation, deletes and workplace updates included, with no annotations and no value masking. --read-only and --config narrow it, and it warns at start-up when a production config or write tools are exposed. Revocation leaks, since the CLI keeps serving its encrypted fallback file after a token is revoked, and open CLI issue #542 reports that secrets delete prints every remaining value in plain text. Activity logs run 3 days on Developer and 90 on Team, and I found no per-read access log. SOC 2 and ISO 27001 claimed and HackerOne for disclosure, while security.txt is blocked by robots.txt. Three, for the defaults on the MCP side. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/doppler https://www.anchorterminal.com/tools/doppler#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Hosted secrets manager organised by project, environment and config.