encrypted-vault-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| VAULT_PATH | No | Override default vault file path (default: ~/.encrypted-vault-mcp/vault.json) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| initA | Initialise a new vault file with a PIN. Fails if a vault already exists at the configured path. The PIN is never stored — only a separate PBKDF2 hash for verification. Default path: ~/.encrypted-vault-mcp/vault.json (override with VAULT_PATH env). |
| unlockA | Unlock the vault for this server session. Derives the AES-256-GCM key from PIN + salt using PBKDF2 (600,000 iterations, SHA-256). On wrong PIN, returns an error. After unlock, store/fetch/list/remove are available until lock is called or the server process exits. |
| lockA | Clear the derived key from memory. After this, store/fetch/list/remove require unlock again. Recommended at the end of a session. |
| storeA | Encrypt a value with AES-256-GCM and save under the given key. A random 96-bit IV is generated per encryption. Overwrites any existing value for the same key. |
| fetchA | Decrypt and return the value for a given key. Errors if the key does not exist. |
| listA | List all keys in the vault. Values stay encrypted on disk. |
| removeB | Permanently delete an item from the vault. |
| change_pinA | Rotate the PIN. Requires the current PIN. Re-encrypts every item with a fresh derived key and new salt. |
| statusA | Report whether the vault file exists, whether it is currently unlocked, the on-disk path, and how many items it contains. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool addresses a unique action: init, unlock/lock for session management, store/fetch/remove for CRUD, list for key enumeration, status for vault info, and change_pin for rotation. No two tools overlap in purpose.
All tool names use consistent lowercase snake_case with a verb_noun pattern (e.g., change_pin, list, store). No mixing of conventions or vague verbs like 'process' or 'do'.
9 tools is ideal for an encrypted vault: covering initialization, authentication, CRUD, listing, status, and PIN rotation. No unnecessary tools and no critical gaps.
The tool surface covers the complete vault lifecycle: init (create), unlock/lock (session), store/fetch/remove (data management), list (inventory), status (health), and change_pin (maintenance). Missing a 'delete vault' tool but that's a rare operation.