Initialise a new vault file with a PIN. Fails if a vault already exists at the configured path. The PIN is never stored — only a separate PBKDF2 hash for verification. Default path: ~/.encrypted-vault-mcp/vault.json (override with VAULT_PATH env).

Unlock the vault for this server session. Derives the AES-256-GCM key from PIN + salt using PBKDF2 (600,000 iterations, SHA-256). On wrong PIN, returns an error. After unlock, store/fetch/list/remove are available until lock is called or the server process exits.

Clear the derived key from memory. After this, store/fetch/list/remove require unlock again. Recommended at the end of a session.

Encrypt a value with AES-256-GCM and save under the given key. A random 96-bit IV is generated per encryption. Overwrites any existing value for the same key.

Decrypt and return the value for a given key. Errors if the key does not exist.

List all keys in the vault. Values stay encrypted on disk.

Permanently delete an item from the vault.

Rotate the PIN. Requires the current PIN. Re-encrypts every item with a fresh derived key and new salt.

Report whether the vault file exists, whether it is currently unlocked, the on-disk path, and how many items it contains.