A vault for .env files and project credentials: one encryption key per project, a second factor before protected values open, an audit row for every reveal, and scoped MCP access for coding agents.
Scored across 33 tools
Most tools are clearly distinct: get_secret (single value) vs get_environment (bulk export) vs pull_env (write-to-file), and create/login/field/secret verbs all target different resources. The cluster around secret discovery (list_secrets, check_keys, search_secrets, diff_environments) is dense but the descriptions draw clear lines between them. A competent agent can select correctly, though a first-time reader may pause on that discovery cluster.
Nearly all tools follow a solid verb_noun snake_case pattern (create_project, get_secret, set_field, delete_login, list_files). Minor deviations are whoami and my_activity, which are idiomatic rather than confusing. No camelCase or wildly inconsistent conventions.
At 33 tools this is on the heavy side of the scale, which the rubric flags as borderline/excessive. However, the surface spans seven genuine resource types (projects, environments, secrets, fields, logins, files, access), so each tool mostly earns its place rather than being filler. Still, some consolidation (e.g. list_secrets/check_keys) could trim the set.
Coverage is strong: full secrets CRUD with history, environment management, project lifecycle, fields, logins, access requests, audit, and identity. Minor gaps exist — files can be listed and downloaded but not uploaded or deleted, and there is no delete_project/delete_environment or member-management mutation. These are workaround-able or intentionally out-of-scope, not fatal.
Record where a project (or one environment) is deployed. Requires projects:write and the editor role.
Inputs: url (required), label (required), project (required), primary, +1 more.
State of a request made with request_access: pending, active (approved and usable), denied, expired, used, ended or revoked.
Inputs: request (required). Returns: keys, note, until, scopes, +6 more
For key names you already have (say, from .env.example), says whether each exists in every environment this token can see, or in one environment. Names only, never values. Requires projects:read.
Inputs: keys (required), project (required), environment. Returns: keys, project, environments
Copy secrets from one environment of a project to another without the values passing through you (they are re-encrypted on the server). Requires secrets:read on the source, secrets:write on the target and the editor role. Protected secrets are skipped.
Inputs: to (required), from (required), project (required), keys, +1 more.
Add an environment (staging, qa, ...) to a project. Requires projects:write and the editor role.
Inputs: name (required), project (required), kind, slug.
Save a password (with URL, username and notes) in a project. Requires logins:write and the editor role.
Inputs: project (required), password (required), url, name, +2 more.
Create a project with its development, preview and production environments; the user becomes its owner. Requires projects:write on a token that reaches all projects.
Inputs: name (required), slug, description.
Delete a project key/value field. Requires projects:write and the editor role; protected projects keep their sensitive fields.
Inputs: key (required), project (required).
Delete a saved login. Requires logins:write and the editor role.
Inputs: login (required), project (required).
Delete a secret and its history. Requires secrets:write and the editor role.
Inputs: key (required), project (required), environment (required).
Which keys exist only in one of two environments of a project and which exist in both with a different value, as key names only: the server compares the stored values and returns none. Protected, sealed and restricted keys are left out of the lists and only counted in hidden. Requires secrets:read on both environments. Audited.
Inputs: to (required), from (required), project (required). Returns: to, from, hidden, project, +3 more
Export every secret of an environment (or a subset of keys) as dotenv, JSON or shell exports. Requires secrets:read. Audited.
Inputs: project (required), environment (required), keys, format. Returns: keys, format, values, leftOut, +2 more
Download a secure (encrypted) file up to 1 MB. Text files come back as text, binaries as base64. Requires files:read. Audited.
Inputs: file (required), project (required). Returns: name, content, encoding, contentType
Reveal one saved login: URL, username, password and notes. Requires logins:read. Every call is audited.
Inputs: login (required), project (required). Returns: url, name, notes, project, +2 more
Environments, deployment URLs and key/value fields of a project. Sensitive field values need secrets:read.
Inputs: project (required). Returns: id, name, role, slug, +7 more
Reveal one secret value. Requires secrets:read. Every call is audited.
Inputs: key (required), project (required), environment (required). Returns: key, value, project, environment
Set many secrets at once from dotenv text (KEY=value lines). Existing keys are kept unless overwrite is true; protected keys and keys outside the token's limits are skipped and named. Requires secrets:write and the editor role.
Inputs: text (required), project (required), environment (required), kind, +1 more.
Environments of a project with their kind and how many keys each holds (the keys list_secrets would name, values never). Environments outside the token's limits are marked restricted and carry no count. Requires projects:read.
Inputs: project (required). Returns: project, environments
Files stored for a project (optionally one environment). Requires projects:read.
Inputs: project (required), limit, cursor, search, +1 more. Returns: files, nextCursor
Saved passwords of a project: name, URL and username, never the password. Requires logins:read.
Inputs: project (required), limit, cursor, search. Returns: logins, nextCursor
Who is on a project and with which role. Requires projects:read and full access to the project.
Inputs: project (required). Returns: members
Projects this token can reach, with your role in each. Requires projects:read.
Inputs: limit, cursor, search. Returns: projects, nextCursor
Keys of an environment without their values (plain, non-secret entries include the value). Requires projects:read.
Inputs: project (required), environment (required), limit, cursor, +1 more. Returns: project, secrets, nextCursor, environment
The audit rows this token (and its earlier rotations) wrote recently: tool, project, keys touched, time. Useful to report what you did.
Inputs: limit. Returns: activity
Write an environment (or a subset of keys) straight to a file on the user's machine without the values passing through you. Returns a one-time shell command (curl or PowerShell) that downloads the export and saves it; the ticket works once and expires in 10 minutes. Requires secrets:read. Audited when issued and when redeemed.
Inputs: project (required), environment (required), file, keys, +1 more. Returns: keys, ticket, project, pullUrl, +2 more
Ask the user for access this token does not have: another environment (production, for example), an extra scope, keys outside the token's allow-list, or protected items. Nothing is granted by calling this: it returns an approveUrl the user must open to approve (with a second factor) or deny. Ask for the narrowest thing that does the job. A client that speaks MCP tasks (protocol 2025-11-25) may call it as a task and poll tasks/get until the user decides.
Inputs: reason (required), scopes (required), project (required), keys, +3 more. Returns: next, asked, status, request, +2 more
Find where a key lives across the projects and environments this token can reach: a substring (database) or a pattern with * (NEXT_PUBLIC_*). Names only, never values. Requires projects:read.
Inputs: query (required), project. Returns: query, matches, truncated, projectsSearched
Versions of one secret: number, who changed it and when. Never the values. Requires projects:read.
Inputs: key (required), project (required), environment (required), limit, +2 more. Returns: key, current, project, versions, +2 more
Create or update a project key/value field (owner contact, region, notes). Requires projects:write and the editor role; a sensitive field also needs secrets:write. Protected projects refuse sensitive writes.
Inputs: key (required), value (required), project (required), sensitive.
Create or update a secret (previous values stay in the version history). Without expectedVersion it writes by key; with it, only while the key is still at that version. Requires secrets:write and the editor role.
Inputs: key (required), value (required), project (required), environment (required), +3 more.
Change a saved login's name, URL, username, password or notes (omitted fields stay as they are). Requires logins:write and the editor role.
Inputs: login (required), project (required), url, name, +3 more.
Rename a project or change its description. Requires projects:write and the owner role.
Inputs: project (required), name, description.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Encrypted store for API keys and database URLs your code needs. Use them without reading them.
Password vault for AI agents with scoped, user-approved access
Project memory, documentation and controlled secret access for AI coding agents.
Encrypted secret store and rotation for autonomous agent credentials
Add one secure layer between your agents and this server.
