auth-vault
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Logging level: debug, info, warn, error | info |
| VAULT_ROOT | No | Storage directory for encrypted vault files | ./vault |
| AUTH_SSE_PORT | No | Enable SSE mode on given port (empty = STDIO mode) | |
| BROWSER_TIMEOUT | No | Browser operation timeout (ms) | 30000 |
| BROWSER_HEADLESS | No | Run Playwright in headless mode | true |
| AUTH_BIND_ADDRESS | No | Explicit bind address for SSE mode | auto (Tailscale) |
| VAULT_ENCRYPTION_KEY | No | AES-256 key (64 hex chars, persist for data survival) | auto-generated |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| store_credentialsB | Store login credentials for a service securely with AES-256-GCM encryption |
| get_credentialsC | Retrieve stored credentials by ID. Returns decrypted username and password. |
| list_credentialsC | List stored credentials, optionally filtered by service |
| delete_credentialsB | Permanently delete stored credentials by ID |
| get_credentials_for_serviceB | Get all credentials for a specific service |
| generate_qrA | Generate a Google Authenticator QR code for a stored credential's TOTP secret |
| list_servicesA | List all supported services with their login templates |
| get_service_templateB | Get detailed login template for a specific service |
| add_serviceB | Register a custom service login template at runtime |
| browser_launchC | Launch a new browser session for logging into a service |
| browser_navigateB | Navigate the browser to a URL within an active session |
| browser_closeA | Close a browser session |
| list_sessionsA | List all active browser sessions |
| login_serviceC | Automate login to a service using stored credentials. Launches browser, fills form, handles captcha. |
| detect_captchaC | Check the current page for captcha challenges |
| solve_captchaB | Solve a detected captcha on the current page using configured captcha service |
| click_submitC | Click the submit button on the login form (useful after captcha solving) |
| detect_2faB | Check the current page for a 2FA code challenge |
| solve_2faA | Generate a TOTP code from the stored secret and fill it into the 2FA input field |
| check_sessionA | Check if a browser session is still active and optionally verify login status |
| store_secretB | Store an API key, access token, or other secret encrypted with AES-256-GCM |
| get_secretA | Retrieve a stored secret by ID (returns decrypted value) |
| list_secretsB | List stored secrets, optionally filtered by service or kind |
| delete_secretB | Permanently delete a stored secret by ID |
| vault_healthB | Comprehensive health check of the auth-vault system — encryption, storage, services, sessions |
| test_credentialB | Test if credentials exist in vault and validate their structure (returns non-sensitive info only) |
| test_session_integrityC | Check if browser sessions are alive and can interact with pages |
| test_totpC | Verify TOTP secret by generating a current code and optionally checking against expected value |
| test_service_selectorB | Test if a CSS selector works on a service's login page (launches browser, checks selector matches) |
| test_secret_expiryA | Check all secrets for expiration — identifies expired, expiring soon, or valid secrets |
| test_browser_cdpB | Test Chrome DevTools Protocol connectivity — verify CDP endpoint is reachable |
| test_all_servicesA | Test all registered service templates — check if login pages are reachable |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 32 tools
Most tools have distinct purposes (credential management, browser automation, captcha/2FA, testing), but some overlap exists between test_* tools and session checks (e.g., test_session_integrity vs check_session), causing minor confusion.
All tool names follow a consistent verb_noun pattern using snake_case, with clear prefixes (browser_, test_, get_, store_, etc.), making the set predictable and easy to navigate.
With 32 tools, the server is over-scoped. Many testing and health tools could be consolidated, and the core authentication/secret operations could be separated into a smaller, focused set.
Core operations for credentials and secrets are present (store, retrieve, delete), but missing update functionality means agents cannot modify existing entries, creating a workflow gap.