save_generated_secret
Save an agent-generated secret into a Vaultwarden/Bitwarden vault collection with end-to-end encryption, rejecting name collisions and setting expiry automatically.
Instructions
Save an agent-generated secret into the mcp-agent-created collection. CREATE-only — cannot overwrite an existing item (name collision returns an error). The secret is E2E-encrypted with the vault org key before transmission. Sets mcp-created-by, mcp-created-at, mcp-expires-at, and mcp-used-in custom fields automatically. Blocked when READ_ONLY=1. Logs to DRY_RUN without creating a real cipher when DRY_RUN=1.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Unique name for this secret within the mcp-agent-created collection. Case-sensitive. Name collision returns an error — pick a distinct name. | |
| type | Yes | Logical type of this secret. "password" for user passwords, "api-key" for API tokens and keys. | |
| notes | No | Optional non-sensitive annotation (e.g. where this key is used). Not the secret itself. | |
| value | Yes | The secret value to store (max 4096 chars). Assumed already generated by the agent. | |
| used_in | No | Free-form context string, e.g. "publish_protected_html @ aiwerk.ch/press/2026-05". Stored as mcp-used-in custom field. | |
| expires_in_days | No | Days until the secret expires (sets mcp-expires-at). Default 30, max 365. |