set_vault_key
Store an encrypted secret in the team vault under a specified environment and key, enabling reference in deploys via vault://env/key. Each write creates a new version.
Instructions
Write a secret to the team vault (PUT /api/v1/vault/:env/:key).
This is the WRITE side of the vault:// references create_deploy advertises. Store a secret here, then reference it from a deploy as vault:/// in env_vars (or resource_bindings) — the api decrypts it at deploy time so the plaintext never sits in your tool params or the deploy record. Closes the gap where create_deploy could point at vault://env/KEY but there was no MCP tool to populate it.
Every write creates a NEW version (v1 on first create, v2+ on updates), so the returned 'version' tells you which generation this call minted. The plaintext value is never echoed back.
Vault is a paid feature: Hobby+ (20 entries) through Pro/Team (unlimited). On anonymous/free you get 403 vault_not_available; at the entry cap you get 402. Hobby/Pro tiers restrict the env to 'production' only — pass env="production" there (the api returns 403 vault_env_not_allowed otherwise).
Requires INSTANODE_TOKEN.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"env": "<env>",
"key": "<key>",
"value": "<value>"
},
"name": "set_vault_key"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| env | Yes | Vault environment namespace (e.g. 'production', 'staging'). Hobby/Pro tiers allow 'production' only. Format: ^[A-Za-z0-9_-]{1,64}$. | |
| key | Yes | Secret key name (e.g. 'DATABASE_URL', 'STRIPE_SECRET_KEY'). Format: ^[A-Za-z0-9_.-]{1,256}$. Reference it later as vault://<env>/<key>. | |
| value | Yes | The secret value (≤1 MiB). Stored encrypted at rest; never echoed back. |