Skip to main content
Glama
agent-vault-mcp

agent-vault-mcp

by Z-6354

Agent Vault

在浏览器里输入凭据,保存到加密数据库,再通过 MCP 把授权的凭据交付为本地文件,供你控制的程序使用。Agent Vault 不绑定某个 Agent 宿主;支持 stdio MCP 的本地宿主可直接接入。

English · 完整安装与宿主配置

人 → 浏览器 / 无回显终端 → 本机连接核心 → 本地加密数据库 / 兼容远程 API
Agent → stdio MCP        → 同一连接核心 → 元数据、录入链接、授权导出的文件路径

MCP 的录入参数和工具返回不包含密钥正文。导出会生成本地明文文件:有文件系统权限的 Agent 可以主动读取它,进而把内容带入模型上下文。选择导出即接受这项风险;这不是“密钥永不被模型读取”的保证。

安装并打开

需要 Git、Python 3.12+。主包唯一运行时第三方依赖是 cryptography>=42,安装包时自动安装,无需 MCP SDK。普通用户不用运行测试即可使用。

Windows PowerShell:

git clone https://github.com/Z-6354/agent-vault.git
cd agent-vault
py -3.12 -m venv .venv
.\.venv\Scripts\python.exe -m pip install .
.\.venv\Scripts\python.exe -m agent_vault open

若 py -3 已指向 Python 3.12 或更新版本,也可用 py -3 -m venv .venv。

Linux:

git clone https://github.com/Z-6354/agent-vault.git
cd agent-vault
python3 --version  # 需为 3.12+
python3 -m venv .venv
./.venv/bin/python -m pip install .
./.venv/bin/python -m agent_vault open

以上按发布仓库根目录包含 pyproject.toml 的布局编写;如果拿到的源码外层还有 vault-core,先进入该目录再创建虚拟环境、安装。

open 自动启动本机后台核心并打开浏览器。首次在页面选择本地或远程:本地金库设置至少 12 位主口令;远程金库使用兼容服务的账号登录。仅选择目标不会创建数据库,创建需要人在页面确认。浏览器未自动打开时,调用 status 并打开本机地址(默认 http://127.0.0.1:43122/),或通过 MCP 的 vault_status 获取 card_url。

Related MCP server: Local Workspace MCP

连接你的 Agent

在宿主中注册 agent-vault-mcp,或虚拟环境里的 Python 加参数 -m agent_vault.mcp_server。command 使用安装后的绝对路径,避免宿主的 PATH、工作目录和当前终端不同。

例如,通用 MCP JSON(示例路径为占位值,请替换为自己的虚拟环境路径):

{
  "mcpServers": {
    "vault": {
      "command": "/absolute/path/agent-vault/.venv/bin/python",
      "args": ["-m", "agent_vault.mcp_server"],
      "env": {"AGENT_VAULT_AGENT_ID": "my-agent"}
    }
  }
}

Windows 的 command 可用 C:/path/to/agent-vault/.venv/Scripts/python.exe。配置后重启或重新连接宿主 MCP。Codex TOML、Claude Code CLI、Windows/Linux 完整示例见接入指南。DSH/Hermes 的共享 router 是可选高级集成,需要另行安装;并非每个宿主自带的通用功能。

录入与交付

  1. Agent 调用 vault_status,人打开 card_url 登录或创建金库。

  2. Agent 调用 vault_begin_enrollment,只提供服务、账号别名、类型和允许操作;人在返回的浏览器页面输入秘密。

  3. Agent 调用 vault_result 确认保存,再用 vault_find 或 vault_list 查询元数据。

  4. 用户授权文件交付后,Agent 调用 vault_export_credential,指定记录、允许的操作和文件名;工具返回路径及元数据,不打印秘密。

account / account_alias 是账号别名,可以是便于区分凭据的标签,不一定是网站用户名。导出 JSON 的 account 仍是该别名;消费程序需要真实用户名时须另行核对。

allowed_operations 可为 chat、completion、embed、read、login、fill,省略或空列表表示仅存储,不能导出。scope 检查和文件名不会打印 secret;不要把秘密放进服务名、别名、提示或文件名。导出 raw 是秘密文本,json 是 {service, account, secret}。用完删除明文文件,避免加入版本控制、日志或共享目录。

远程与手机的边界

默认不设置 AGENT_VAULT_SERVER_URL,首次由用户选本地或远程。可选远程地址示例为 https://example.com;已确认保存的目标优先于环境默认值。

远程模式是兼容 Agent Vault Service v1 API 的客户端适配器,本包不包含通用远程数据库服务的生产托管、部署或账户管理方案。并非任意密码管理器或数据库 URL 都能连接;服务需实现认证、凭据读写、权限解析和授权取用接口。远端存储保护由该服务负责,具体契约见接入指南。

浏览器服务仅监听本机 loopback。手机上的 localhost / 127.0.0.1 指手机自身,不能直接访问电脑页面;移动浏览器布局适配不代表已提供跨设备网络通道。SSH 场景可使用端口转发,在受控设备浏览器完成输入。

云托管 Agent 仅在厂商官方明确支持远程 MCP 或安全输入、并能把操作交付到你控制的后端时才可评估接入。本包的 MCP 是本地 stdio,不自带远程 MCP 网关;没有官方能力时使用浏览器/TTY 完成人工录入及本地程序交付,不能保证厂商集成。

安全与支持状态

本地凭据保存在加密 SQLite 数据库,设备登录记忆使用平台保护;关闭网页不等于退出。页面的“退出并忘记此设备”会清除登录记忆。选择不记住设备时,核心重启后需重新登录,本次认证最多一小时。

文件权限、Windows DPAPI 等是当前用户级保护,无法防御同用户高权限进程、调试器或已获文件访问权的模型。AGENT_VAULT_AGENT_ID 是宿主自声明的审计标识,不是强身份认证。受控执行仅限实际注册的操作,不能因允许了 chat 就推断任何模型服务都已集成。

本机已验证 Windows 与 Ubuntu/WSL(含真实无回显终端),并验证从构建包全新安装后的浏览器→MCP→文件交付。Windows、Linux、macOS 的 Python 3.12/3.14 组合由 GitHub CI 持续验证,以对应提交的实际检查结果为准。开发测试命令见接入指南。

License

MIT,见 LICENSE。

Available Tools

14 tools
execute_operationC

Execute a registered operation inside the local core; remote legacy consume is not exposed.

NameRequiredDescriptionDefault
request_idYes
operation_idYes
connection_idYes
expected_record_versionYes

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full behavioral burden, yet it discloses almost nothing: not whether execution mutates remote state, whether it is idempotent, what permissions or prerequisites it needs, or what happens on failure. The one useful signal is the local-core-vs-remote-legacy scoping note, plus the implied optimistic concurrency from expected_record_version, which the description itself never mentions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the two clauses are well ordered: capability first, scope limit second. It is terse but not padded, though the terseness comes at the cost of content rather than being efficient density.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is an unnamed write-path execution tool with four mandatory parameters, no annotations, and no output schema, so the description is the only behavioral source — and it barely covers any of it. It neither explains the required inputs nor what the call returns, which is inadequate for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four required parameters, and the description adds no meaning for any of them. request_id (32-char), connection_id (36-char), operation_id, and expected_record_version are left entirely opaque — an agent must guess whether request_id is a caller-generated idempotency key and what version conflicts mean.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb is concrete ("Execute") and the resource is "a registered operation inside the local core," but "operation" is never defined, so an agent cannot tell what class of work this performs. It also fails to differentiate from close siblings such as list_operations, get_operation_status, and prepare_request, other than a vague note that "remote legacy consume is not exposed."

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only guidance is a negative scoping clause about a legacy remote consume path, which is not a use case an agent can act on. Nothing says when to call this instead of get_operation_status or list_operations, nor whether a request must first be prepared via prepare_request.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_connection_statusC

Get connection metadata.

NameRequiredDescriptionDefault
connection_idYes

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden and mostly fails it. 'Get' weakly implies a read-only operation, but nothing states permissions, whether the connection_id must reference an existing connection, or what happens on an unknown ID.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short, front-loaded sentence with no wasted words, but here the brevity is under-specification rather than efficiency. There is no structure to speak of because there is only one clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and 0% parameter coverage, the description is the only source of behavioral and return-value information, and it supplies none. Even for a simple single-parameter lookup, an agent is left guessing what 'metadata' contains and whether the call is safe or side-effect free.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the sole required parameter, connection_id, and the description adds no meaning: it never says the parameter identifies which connection's metadata is fetched. Only the schema's 36-character length constraint hints at the identifier format, and that comes from the schema, not the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a verb ('Get') and a resource ('connection metadata'), which is more than a tautology, but 'metadata' is undefined and it does not distinguish this tool from siblings like list_connections or get_operation_status. An agent cannot tell exactly what is returned or how this differs from those lookups.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no preconditions, and no mention of alternatives such as list_connections for enumeration versus this per-connection lookup. The agent must infer usage entirely from the tool name and the single required parameter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_operation_statusC

Get durable operation result.

NameRequiredDescriptionDefault
request_idYes
operation_idYes

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and delivers almost nothing. It does not say whether the call blocks while an operation is pending, what happens for unknown or expired operation_ids, whether it requires authentication, or how errors are surfaced; only 'durable' gestures vaguely at persistence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single front-loaded sentence with no filler, but the brevity comes at the cost of substance rather than being earned. There is nothing to structure because almost nothing is said.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description should explain what the returned 'result' looks like, including pending/failed states. It only alludes to a result existing, leaving the agent unable to interpret the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description mentions neither request_id nor operation_id. The agent gets no explanation of what a 32-character request_id is, where it comes from, or how operation_id relates to it, so the description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb 'get' and resource 'operation result' are stated, and 'durable' hints at persisted async operations. But it is too terse to distinguish it from siblings like list_operations or get_connection_status, and 'durable' is left undefined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to call this versus list_operations or get_connection_status, and no mention of prerequisites such as having obtained an operation_id from execute_operation. The agent must infer the workflow entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_connectionsC

List connection metadata only.

NameRequiredDescriptionDefault

No parameters

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. "Metadata only" is a useful hint that secrets/credentials are excluded, but there is no disclosure of permissions required, pagination or ordering behavior, or whether results are cached/sensitive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The sentence is short and front-loaded with the verb, which is good, but at seven words it is terse to the point of under-specification rather than effectively concise. A single additional clause naming the returned fields would have been cheap and high-value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description is the only source of information about this tool, and it does not say what fields the connection metadata contains or how it is scoped. For a listing tool whose return shape is undocumented elsewhere, this leaves a substantive gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline is 4. The single caveat is that the description cannot add meaning to an empty schema, and it does not clarify whether any implicit scoping (tenant, target) applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a verb ("List") and a resource ("connection metadata"), so the basic intent is legible, and "metadata only" hints at scope. However it does not differentiate from siblings such as get_connection_status or vault_list, leaving the agent to infer whether this returns connections, connection states, or something else.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to call this versus get_connection_status or vault_list. The word "only" implies a boundary (metadata, not credentials) but no explicit when/when-not guidance or alternative routing is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_operationsC

List controlled operations supported by the selected backend.

NameRequiredDescriptionDefault

No parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses only that results are scoped to the selected backend; it says nothing about whether this is read-only (implied by "List" but unconfirmed), whether a backend must be selected first, what happens if none is selected, or what the returned entries look like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler or repetition. It is efficient, though its terseness borders on under-specification rather than optimal compression.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-parameter discovery tool, the description is minimally adequate. With no output schema and no annotations, it should still clarify what a "controlled operation" is and what a caller gets back, since that is the entire value of a list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter semantics for the description to add. Baseline 4 applies; the mention of backend scoping is a bonus constraint rather than a parameter explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a verb ("List") and a resource ("controlled operations supported by the selected backend"), which is more than a tautology. However, "controlled operations" is never defined, and the description does not distinguish this from siblings such as execute_operation, get_operation_status, or list_connections, so an agent cannot tell precisely what is being enumerated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use statement and no mention of alternatives. The phrase "supported by the selected backend" hints at a prerequisite (a target must be selected, cf. vault_select_target) but never states it, leaving the agent to infer both the trigger condition and the ordering constraint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

prepare_requestC

Create a controlled operation ticket.

NameRequiredDescriptionDefault
operation_nameYes

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description bears the full burden of behavioral disclosure and fails to meet it. "Create" implies a mutation, yet nothing is said about side effects, whether the ticket expires, whether it must be approved by another party, or what authorization is required for the operation to be "controlled."

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is front-loaded and wastes no words, but here brevity is under-specification rather than efficiency. A few more clauses about sequencing and the meaning of operation_name would earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and an undocumented parameter, the definition supplies almost no information an agent needs to invoke this correctly. The relationship to execute_operation and get_operation_status, which likely consume the produced ticket, is entirely unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 0% schema description coverage (no description on operation_name, only length constraints), so the description must compensate and does not. It never explains whether operation_name is a free-form label, must match a value from list_operations, or how it is used downstream.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a verb and a resource ("Create a controlled operation ticket"), but "controlled operation ticket" is undefined jargon. An agent cannot tell from this whether the ticket is a permission request, a job handle, or an audit record, nor how it relates to siblings like execute_operation or get_operation_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus execute_operation, list_operations, or the vault_* tools. No prerequisites, no stated sequencing (e.g., prepare then execute), and no exclusions are given, leaving the agent to guess at a workflow position.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_begin_enrollmentC

Request credential entry in the browser. Never pass secrets.

NameRequiredDescriptionDefault
promptNo
accountYes
serviceYes
credential_typeNo
allowed_operationsNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that credential entry happens in the browser and that secrets must not be passed, but it omits lifecycle details such as whether the tool returns immediately, whether it opens a browser automatically, and how completion is retrieved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short, front-loaded sentences with no unnecessary wording. Both sentences carry relevant information: the browser-based entry action and the secret-handling constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter enrollment tool with no annotations, no output schema, and no schema descriptions, the description is too sparse. It communicates the core browser-entry concept but leaves parameter meaning, return behavior, and follow-up flow undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needs to explain the five parameters. It mentions none of service, account, prompt, credential_type, or allowed_operations, and provides no meaning for the enum values beyond a general 'never pass secrets' warning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: request credential entry in the browser. It clearly indicates an enrollment-like interaction rather than retrieval, but it does not explicitly distinguish this tool from siblings such as vault_export_credential or vault_result.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Request credential entry in the browser' implies when to use the tool, and 'Never pass secrets' gives an important usage constraint. However, it does not state when to use alternatives such as vault_result or vault_decline, nor does it define prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_declineC

Decline an enrollment.

NameRequiredDescriptionDefault
request_idYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full disclosure burden for a mutation operation. It does not say whether declining is reversible, whether a reason is recorded, what permissions are needed, or what happens to the enrollment record afterward; only the word 'Decline' hints at state change.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single short sentence is front-loaded and contains no filler, which is good. However, at three words it crosses from concise into under-specified, so brevity here is not fully earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations, no output schema, and an undocumented required identifier, the definition leaves an agent without the information needed to invoke it confidently. It should at minimum explain the request_id source and the effect of declining.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single required parameter request_id has 0% schema description coverage, and the description adds nothing about its meaning, format, or where to obtain it. The only clue is the 32-character length constraint in the schema, which the description never reinforces or explains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Decline an enrollment'), which is enough to tell it apart conceptually from vault_begin_enrollment as the opposing action. It does not explain what an 'enrollment' is in this vault context, but the action itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to decline versus when to use vault_begin_enrollment, vault_select_target, or any other sibling. No prerequisites, no conditions, and no exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_export_credentialA

Write a stored credential to a protected local file and return only the file path. The secret never appears in this result; an agent with file access can read the file afterwards. format=json writes {service, account, secret} for login-style use.

NameRequiredDescriptionDefault
formatNo
filenameYes
operationYes
destinationNo
connection_idYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose the critical traits: the target is a protected local file, the secret is deliberately excluded from the result, and an agent with file access can read it afterwards. Missing are overwrite behavior (does filename clobber an existing file?), permission/auth requirements, and what 'protected' concretely means, which matters for a secret-writing operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with no filler, and the most decision-relevant fact (the secret never appears in the result) is placed early. The format detail is appended last where it belongs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers the return shape and one parameter for a tool with no output schema and no annotations, which is a solid start. But for a five-parameter, security-sensitive export operation, the unexplained destination/filename semantics and absent overwrite or auth notes leave real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across five parameters, so the description must compensate and largely does not. It explains only the format enum ('format=json writes {service, account, secret}'), leaving connection_id, operation, filename, and especially destination undocumented — the filename vs destination relationship is entirely ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: write a stored credential to a protected local file, returning only the path. It implicitly separates itself from read-only siblings like vault_list and vault_find by emphasizing that the secret is not returned inline, but it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied (an agent that needs the secret on disk rather than in the response), and the login-style json case is flagged for format=json. However, it never states when to prefer vault_list/vault_find over this export, nor any prerequisite or exclusion, so the routing decision is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_findC

Find credential metadata by service.

NameRequiredDescriptionDefault
service_idYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Find' implies a read-only lookup and 'metadata' signals that credential secrets are not returned, which is useful context. However, it does not state matching behavior, auth requirements, empty-result handling, or whether results are paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is front-loaded and contains no wasted wording. It is perhaps excessively terse for a tool with an undocumented parameter, but the phrasing itself is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter lookup with no annotations and no output schema, the description is too sparse. It does not explain what metadata fields are returned, how matching works, or how the tool relates to sibling vault tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter service_id has 0% schema description coverage. 'By service' weakly maps to the parameter but does not clarify whether the value is an opaque ID, a service name, or a specific format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: find credential metadata. It also scopes the lookup by service, and saying metadata rather than credential helps distinguish it from vault_export_credential. It does not explicitly differentiate among vault_list or vault_select_target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool rather than vault_list, vault_status, or other siblings. The only implied usage is when a service identifier is known, but no alternatives or exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_listB

List credential metadata only.

NameRequiredDescriptionDefault

No parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. The phrase 'metadata only' usefully indicates secrets are not returned, but it omits permissions, authentication requirements, pagination, and return shape, leaving significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no unnecessary words. It is appropriately sized for a zero-parameter list tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple no-parameter list tool with no output schema, the description is minimally adequate but incomplete. It does not explain what metadata fields are returned or whether results are filtered, which an agent would need to know.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and full schema coverage, so the baseline is 4. The description adds no parameter details because none exist, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (List) and resource (credential metadata), making the core purpose clear. It does not differentiate from siblings like vault_find or vault_export_credential, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as vault_find or vault_export_credential. The implied usage is to list credentials, but no explicit context or exclusions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_resultC

Read enrollment state/reference only.

NameRequiredDescriptionDefault
request_idYes

TDQS

C2.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses read-only behavior, which is worth something, but says nothing about authorization needs, what happens when a request is still pending or declined, or whether anything is mutated as a side effect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no filler, which is fine structurally, but the brevity comes at the cost of clarity rather than from efficient information density.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a lookup tool that takes an opaque id and has no output schema, the description should explain what the returned state looks like and how it relates to the prepare/begin-enrollment flow. Neither is present, leaving the agent unable to use the result meaningfully.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter, request_id, with 0% schema description coverage, and the description says nothing about it. It does not explain where the 32-character request_id comes from (presumably prepare_request or vault_begin_enrollment) or what an invalid/stale id yields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase 'Read enrollment state/reference only' gestures at a read of enrollment state but never says what is returned or what 'reference' means. It does not distinguish this from siblings like vault_status, vault_find, or get_operation_status, so an agent cannot tell what resource this actually resolves.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'only' hints at a read-only scope but there is no explicit when-to-use guidance, no prerequisites, and no naming of alternatives among the many vault_* and status siblings. Usage must be inferred entirely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_select_targetB

Select local or probe a user-specified HTTPS vault server. No database is created and no old session is replaced until browser authentication succeeds.

NameRequiredDescriptionDefault
modeYes
server_urlNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does deliver real behavioral context: no database is created and no existing session is replaced until browser authentication succeeds, which tells the agent this is a non-destructive, gated operation. However, 'probe' is unexplained — no indication that it performs a network request to the given URL, what a failure looks like, or what the response returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences with the scope stated up front and the safety caveat second; nothing is wasted. The phrasing 'Select local' is slightly clipped and could read more naturally as 'select a local vault'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter, non-destructive setup tool with no output schema and no annotations, the description covers the important side-effect guarantee but omits what happens on a failed probe and how return values differ between local and remote modes. Adequate, but not complete enough to call it robust.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and it only partly does: it adds the meaningful constraint that the server URL must be HTTPS, which the schema does not state. It never says that server_url is required when mode=remote, or that it is ignored when mode=local, leaving the mode/parameter relationship ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Select') and resource ('local or ... HTTPS vault server'), and makes the local-vs-remote distinction explicit, which is the core of this tool. It does not name any sibling tool, so the boundary with vault_begin_enrollment or vault_status must be inferred.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the two modes are described, so an agent can guess this is the entry point for choosing a target before other vault operations. There is no explicit 'use this before X' or 'do not use when Y', and no mention of the alternative flow (e.g. enrollment) that the sibling tools suggest.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_statusC

Connection state and safe browser link; never secrets.

NameRequiredDescriptionDefault

No parameters

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. 'Never secrets' is a genuinely useful guarantee about what the response excludes, but nothing is said about whether this is a read-only operation, what the connection state values look like, whether the 'safe browser link' is always present or only in some states, or whether the call has side effects. This is a significant gap for the only available source of behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Seven words is admirably short and front-loaded, but the brevity comes at the cost of a verb and any usable context, so it reads as under-specification rather than effective concision. The semicolon clause about secrets is the strongest part of the sentence and is buried at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a low-complexity, zero-parameter tool, which lowers expectations, but there are no annotations and no output schema, so the description is the only place an agent can learn what comes back. It names two return concepts without explaining their shape or relation, and it omits differentiation from the closely related get_connection_status sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is empty with additionalProperties=false, so there is nothing for the description to clarify. Baseline 4 applies for a no-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a noun phrase with no verb: 'Connection state and safe browser link' essentially restates the name vault_status rather than stating what the tool does (e.g., 'Returns the current vault connection state and a safe browser link'). It also fails to distinguish this from the sibling get_connection_status, whose purpose appears to overlap. Only the 'never secrets' clause adds anything an agent could not infer from the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance at all — no indication of when an agent should call vault_status versus get_connection_status, vault_result, or vault_list. The agent must infer the trigger condition entirely. No exclusions or prerequisites are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 14 tool updatesv2.0.0
    • First observedexecute_operation
    • First observedget_connection_status
    • First observedget_operation_status
    • First observedlist_connections
    • First observedlist_operations
    • First observedprepare_request
    • First observedvault_begin_enrollment
    • First observedvault_decline
    • First observedvault_export_credential
    • First observedvault_find
    • First observedvault_list
    • First observedvault_result
    • First observedvault_select_target
    • First observedvault_status

TDQS

C2.8/5.0

Scored across 14 tools

Disambiguation4/5

Most tools target distinct resources and lifecycle steps (list vs find metadata, begin_enrollment vs result vs decline, prepare_request vs execute_operation). The main ambiguity is between vault_status and get_connection_status, and the trio vault_list / list_connections / list_operations could be momentarily confused since all are read-only metadata listings. Descriptions mostly disambiguate these, but the 'status' pair overlaps in spirit.

Naming Consistency3/5

Names are broadly snake_case verb_noun, but split into two families: a vault_-prefixed group and a bare verb group (list_operations, prepare_request, execute_operation). Within the vault family the convention is also mixed, with verbs (vault_list, vault_find, vault_decline) alongside noun-style names (vault_status, vault_result). Readable, but not a single predictable pattern.

Tool Count4/5

Fourteen tools sits comfortably in the sensible 3-15 range and each tool maps to a real step: target selection, enrollment lifecycle, metadata reads, and the operation ticket flow. It is slightly heavy given the enrollment flow spreads over three tools, but nothing feels redundant at scale.

Completeness3/5

The surface covers connection, discovery, enrollment, operation ticketing, execution, and credential export, but there are notable gaps: no way to update, rotate, revoke, or delete a stored credential or connection. An agent that enrolls a credential has no matching lifecycle tool to retire it, which could cause dead ends.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables secure delivery of Bitwarden Secrets Manager secrets to approved local files without exposing secret values to the MCP client or model. It provides metadata-only secret discovery and atomic file writes for single secrets or raw env files.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables teams to securely store and retrieve credentials, view decrypted secrets or live OAuth tokens, and connect to third-party MCP servers through a unified MCP endpoint.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables self-hosted remote access to a user-controlled device's approved filesystem roots, allowing clients to list directories, read and search files, inspect metadata, ping the agent, and list devices through an MCP tunnel.
    AGPL 3.0