@aiwerk/mcp-server-vault

get_totp_code

Read-only

Get the current 6-digit TOTP code for a vault login item, along with the remaining seconds in the period and the algorithm, so you know whether to use it immediately or wait for a fresh code.

Instructions

Get the current TOTP code for a vault login item with TOTP configured. Returns the 6-digit code, the remaining seconds in the current period, and the algorithm. Use the remaining_seconds field to decide whether to use the code immediately or wait for a fresh period.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "get_totp_code"
  }
}

Input Schema

Name	Required	Description	Default
`name`	Yes	Exact item name (case-sensitive) of a vault login item with TOTP configured.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.2.2Aug 14, 2026

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful context about the return values and how to interpret remaining_seconds, but beyond that it mainly restates the read-only nature already captured by readOnlyHint=true. No hidden side effects, permissions, or rate limits are disclosed, so it adds limited extra value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core function and includes only actionable information. It is appropriately sized for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with readOnlyHint and no output schema, the description adequately covers the return values and provides actionable guidance on using remaining_seconds. It lacks error handling details, but that is not critical for basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully describes the name parameter with details on exact, case-sensitive matching. The description reinforces this but does not add new meaning beyond the schema, aligning with the baseline for 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get the current TOTP code for a vault login item with TOTP configured,' specifying the verb, resource, and condition. It also lists the return fields, distinguishing it from sibling tools like save_login_item or reveal_secret_via_send.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it is for vault login items with TOTP configured, and advises using remaining_seconds to decide when to use the code. However, it does not explicitly mention alternatives or when-not-to-use, so it falls short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server