llm-vault-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| HOST | No | Host for the Streamable HTTP transport (e.g., 127.0.0.1). | |
| PORT | No | Port for the Streamable HTTP transport (e.g., 3000). | |
| MCP_TOKEN | No | Bearer token used for MCP authentication when running the loopback Streamable HTTP transport. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| vault_statusA | Query active MCP vault connection status, agt_ identity, OS keychain unlock state, and permission scopes. |
| vault_searchA | Search accessible vaults by keyword, tag blind index, or folder. Decrypts item metadata locally and returns safe summaries with opaque handles. |
| vault_list_tagsB | List unique decrypted tag labels across accessible vaults. |
| vault_get_secretA | Resolve a secret by sec_ and return an opaque surrogate handle ({{vault:sec_}}) by default. Raw plaintext reveal is blocked unless break-glass policy and out-of-band human confirmation are satisfied. |
| vault_lease_secretB | Acquire a time-bounded lease_ handle holding decrypted secret bytes in MCP memory. Automatically zeroes the buffer upon TTL expiration. |
| vault_revoke_leaseB | Explicitly revoke an active lease_ handle and immediately zeroize its in-memory buffer. |
| vault_run_commandB | Execute a subprocess with {{vault:sec_}} or {{vault:lease_}} handles injected into environment variables, scrubbing stdout and stderr for raw, Base64, and URL-encoded secret leaks. |
| vault_inject_envC | Resolve opaque secret or lease handles into a subprocess execution environment and return scrubbed command output. |
| vault_http_proxyB | Execute an outbound HTTP request with {{vault:sec_}} or {{vault:lease_}} handles injected into request headers and scrub echoed credentials from response headers and body. |
| vault_generate_and_store_secretB | Generate a high-entropy secret inside llm-vault-mcp via crypto.getRandomValues(), encrypt it locally with VaultKey and canonical AAD, and return only { id, vaultId, version, handle }. |
| vault_prompt_secret_oobC | Prompt a human operator out-of-band (OOB) to enter a secret directly into client-side WebCrypto encryption without exposing the value in chat context. |
| vault_delete_secretA | Delete a secret item from the vault. Requires 'secrets:delete' scope and out-of-band human confirmation. Returns a pending confirmationToken when unconfirmed. |
| vault_confirm_actionA | Confirm or cancel a pending destructive action or break-glass reveal using an out-of-band confirmation token. |
| vault_admin_audit_logsA | Read-only query and HMAC-SHA256 hash-chain verification of aud_ audit logs for ComplianceAuditor tokens. User, role, and IdP admin mutations are excluded from MCP. |
| vault_scan_workspaceB | Scan workspace files, git staged diffs, or direct text content for unencrypted credentials, returning structured findings with line numbers, entropy, and suggested {{vault:sec_}} handles. |
| vault_absorb_credentialsB | Extract unencrypted secrets from a file (e.g. .env), encrypt them locally with VaultKey + AAD into sec_ records, and generate {{vault:sec_}} template (.env.tpl). |
| vault_install_pre_commit_hookA | Install, check status of, or remove a zero-dependency git pre-commit hook that blocks unencrypted secrets from git staging. |
| vault_ssh_agent_statusB | Inspect active SSH agent status, loaded Ed25519 signing keys, socket path, and interactive/OOB approval policies. |
| vault_k8s_eso_templateC | Generate ready-to-apply Kubernetes External Secrets Operator (ESO) SecretStore and ExternalSecret manifests for zero-knowledge vault synchronization. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 19 tools
Most tools target clearly distinct resources or actions, but vault_run_command and vault_inject_env overlap heavily: both inject secret/lease handles into a subprocess environment and return scrubbed output. Other adjacent pairs like get vs lease and scan vs absorb remain distinguishable from their descriptions.
Every tool uses lower snake_case with a consistent vault_ prefix, and the verb/noun structure is predictable across the set. There is no mixing of naming conventions.
19 tools is somewhat heavy, but the scope includes vault access, leasing, execution, import, scanning, audit, and external integrations, so most tools earn their place. The main redundancy is the run-command vs inject-env overlap.
The surface covers create, read, lease, delete, audit, scanning, and integrations well, but there is no explicit secret update/rotate operation or tag-mutation tool. Agents can work around rotation by deleting and recreating or absorbing secrets again, so these are notable but not fatal gaps.