Secure Vault
If you're tired of hardcoding API keys in MCP configs or passing them through Claude as plaintext, this server gives agents a token-based secrets flow. Store credentials encrypted with AES-256-GCM, then issue short-lived scoped tokens that agents exchange for injected requests. The agent never sees the raw secret. You get store_secret, get_agent_token, inject_secret_to_request for the core workflow, plus rotate_secrets to invalidate old tokens, audit_secret_access for a full access trail, and scan_config_for_leaks to catch AWS keys, GitHub tokens, and other credentials before they hit version control. Secrets live in memory for the session. Useful when you're building multi-agent systems that need to call external APIs without leaking credentials in logs or prompts.
- tools
- 6
- transport
- STDIO
- last updated
- Apr 24, 2026
Tools
6 toolsPublic tool metadata for what this MCP can expose to an agent.
store_secretStore an encrypted secret with optional rotation policy.
Store an encrypted secret with optional rotation policy.
No parameter schema in public metadata yet.
get_agent_tokenIssue a short-lived, scoped token. The agent receives an opaque token ID, never the raw secret.
Issue a short-lived, scoped token. The agent receives an opaque token ID, never the raw secret.
No parameter schema in public metadata yet.
rotate_secretsRotate all secrets for a service. Old tokens are invalidated.
Rotate all secrets for a service. Old tokens are invalidated.
No parameter schema in public metadata yet.
audit_secret_accessView who accessed what secrets over a time range.
View who accessed what secrets over a time range.
No parameter schema in public metadata yet.
scan_config_for_leaksScan config text for exposed secrets. Detects AWS keys, GitHub tokens, OpenAI/Anthropic keys, Slack tokens, Stripe keys, private key blocks, bearer tokens, and generic credentials using 12 regex patterns.
Scan config text for exposed secrets. Detects AWS keys, GitHub tokens, OpenAI/Anthropic keys, Slack tokens, Stripe keys, private key blocks, bearer tokens, and generic credentials using 12 regex patterns.
No parameter schema in public metadata yet.
inject_secret_to_requestReturn a request with the secret injected server-side. The agent provides a template with {{SECRET}} placeholder and a valid token ID.
Return a request with the secret injected server-side. The agent provides a template with {{SECRET}} placeholder and a valid token ID.
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
secure-vault-mcp
MCP server for agent-native secrets management. 24,008 secrets have been found in MCP config files on public GitHub. This server solves that.
Agents need secrets to call APIs, but they shouldn't see raw values. secure-vault-mcp stores secrets encrypted with AES-256-GCM, issues short-lived scoped tokens, and injects secrets into requests server-side so the agent never handles plaintext credentials.
Install
npx secure-vault-mcp
Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"secure-vault": {
"command": "npx",
"args": ["secure-vault-mcp"]
}
}
}
From source
git clone https://github.com/mdfifty50-boop/secure-vault-mcp.git
cd secure-vault-mcp
npm install
node src/index.js
Tools
store_secret
Store an encrypted secret with optional rotation policy.
Details
- Repository
- github.com/mdfifty50-boop/secure-vault-mcp
- Package
secure-vault-mcp- Transport
- STDIO
- Registry
- MCP registry, active