proton-pass-community-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PASS_CLI_BIN | No | Path or command for the pass-cli binary | |
| PASS_CLI_ALLOW_VERSION_DRIFT | No | Allow version drift (true/false) to treat semver mismatch as compatible |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| view_session_infoA | View current Proton Pass session/account summary from pass-cli info. |
| check_statusA | Run preflight checks for connectivity/authentication and CLI version compatibility. |
| injectC | Inject secrets from Proton Pass references into a template file. |
| runC | Run a command with Proton Pass secret references resolved in environment. |
| view_user_infoA | View Proton user profile/account details from pass-cli user info. |
| list_vaultsA | List vaults accessible to the current authenticated user. |
| create_vaultC | Create a new vault. |
| update_vaultC | Update a vault by share ID or vault name. |
| share_vaultC | Share a vault with a user. |
| transfer_vaultB | Transfer vault ownership to a member. |
| delete_vaultC | Delete a vault by share ID or vault name. |
| list_sharesA | List shares accessible to the current authenticated user. |
| list_invitesA | List pending invitations accessible to the current authenticated user. |
| accept_inviteC | Accept an invitation token. |
| reject_inviteB | Reject an invitation token. |
| view_settingsA | View current Proton Pass CLI settings. |
| set_default_vaultC | Set default vault by share ID or vault name. |
| unset_default_vaultC | Unset default vault setting. |
| generate_random_passwordC | Generate a random password. |
| generate_passphraseC | Generate a passphrase. |
| score_passwordC | Score password strength. |
| generate_totpA | Generate a TOTP token from a secret or otpauth URI. |
| list_vault_membersA | List members for a vault by share ID or vault name. |
| update_vault_memberC | Update a vault member role. |
| remove_vault_memberC | Remove a member from a vault. |
| list_itemsB | List items for a vault or share with MCP pagination support for JSON output. |
| view_itemA | View a specific item by URI or selectors, optionally returning a specific field. |
| generate_item_totpB | Generate TOTP code(s) for an item by URI or selectors, optionally targeting a specific field. |
| create_login_itemC | Create a login item in a vault or share. |
| create_login_item_from_templateB | Create a login item from template JSON. |
| create_note_itemB | Create a note item in a vault or share. |
| create_credit_card_itemB | Create a credit card item in a vault or share. |
| create_wifi_itemA | Create a WiFi item in a vault or share. |
| create_custom_itemB | Create a custom item from template payload in a vault or share. |
| create_identity_itemC | Create an identity item from template payload in a vault or share. |
| move_itemC | Move an item from one vault to another. |
| update_itemC | Update an item using selectors and field assignments. |
| trash_itemC | Move an item to trash by selectors. |
| untrash_itemB | Restore an item from trash by selectors. |
| delete_itemA | Permanently delete an item by share ID and item ID, bypassing trash. |
| download_item_attachmentA | Download an item attachment to a local path, potentially overwriting it. Requires write permission and confirmation. |
| create_item_aliasB | Create an email alias item. |
| list_item_membersC | List item members. |
| update_item_memberB | Update an item member role. |
| remove_item_memberC | Remove an item member. |
| share_itemC | Share an item with a user. |
| search_itemsA | Search items by title with MCP pagination support for JSON output. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| item_create_templates | Catalog of pass-cli item create templates captured for dev/testing. |
| item_create_template_credit_card | Template snapshot for pass-cli item create credit-card. |
| item_create_template_custom | Template snapshot for pass-cli item create custom. |
| item_create_template_identity | Template snapshot for pass-cli item create identity. |
| item_create_template_login | Template snapshot for pass-cli item create login. |
| item_create_template_note | Template snapshot for pass-cli item create note. |
| item_create_template_wifi | Template snapshot for pass-cli item create wifi. |
TDQS
Scored across 47 tools
Most tools map to distinct resource-action pairs: vaults, items, members, invites, attachments, and utilities are clearly separated. A few boundary cases like create_login_item_from_template versus create_custom_item or list_shares versus list_vaults could cause minor confusion, but the descriptions generally resolve it.
The dominant verb_noun snake_case pattern is consistent across the set: list_vaults, create_vault, trash_item, untrash_item, share_vault, and so on. The main deviations are generic single-verb tools like inject and run, plus verbose template-based creation variants, but the overall pattern remains predictable.
47 tools is a very large MCP surface, beyond what is typically comfortable for agent tool selection. Many tools are narrowly scoped variants, such as eight item-creation tools and separate member-management clusters, which could potentially be consolidated without losing clarity.
The tool set covers the full password-manager workflow well: vault lifecycle, item lifecycle with trash/restore/permanent delete, sharing and invitations, member management, TOTP, password generation, and session/settings checks. Minor gaps like uploading or updating attachments keep it from being a 5, but agents can complete common workflows without dead ends.