set_vault_key
Store an encrypted secret in the team vault under a specified environment and key, enabling reference in deploys via vault://env/key. Each write creates a new version.
Instructions
Write a secret to the team vault (PUT /api/v1/vault/:env/:key).
This is the WRITE side of the vault:// references create_deploy advertises. Store a secret here, then reference it from a deploy as vault:/// in env_vars (or resource_bindings) — the api decrypts it at deploy time so the plaintext never sits in your tool params or the deploy record. Closes the gap where create_deploy could point at vault://env/KEY but there was no MCP tool to populate it.
Every write creates a NEW version (v1 on first create, v2+ on updates), so the returned 'version' tells you which generation this call minted. The plaintext value is never echoed back.
Vault is a paid feature: Hobby+ (20 entries) through Pro/Team (unlimited). On anonymous/free you get 403 vault_not_available; at the entry cap you get 402. Hobby/Pro tiers restrict the env to 'production' only — pass env="production" there (the api returns 403 vault_env_not_allowed otherwise).
Requires INSTANODE_TOKEN.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| env | Yes | Vault environment namespace (e.g. 'production', 'staging'). Hobby/Pro tiers allow 'production' only. Format: ^[A-Za-z0-9_-]{1,64}$. | |
| key | Yes | Secret key name (e.g. 'DATABASE_URL', 'STRIPE_SECRET_KEY'). Format: ^[A-Za-z0-9_.-]{1,256}$. Reference it later as vault://<env>/<key>. | |
| value | Yes | The secret value (≤1 MiB). Stored encrypted at rest; never echoed back. |