@lobsterkit/vault-mcp
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOBSTERVAULT_API_KEY | No | API key (skips auto-signup and file persistence) | |
| LOBSTERVAULT_API_URL | No | Custom API base URL (default: https://api.theclawdepot.com/vault) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| set_secretA | Store or update a secret. The value is envelope-encrypted server-side using AWS KMS. Returns the new version number. |
| get_secretA | Retrieve and decrypt a secret value by name. Returns null if not found. Pass a version number to retrieve a specific historical version (Builder+ tier). |
| delete_secretA | Permanently delete a secret. |
| list_secretsA | List all secret names on the account. Values are never returned in list operations. |
| inject_secretsA | Load all secrets into the process environment (process.env). Returns the count of secrets injected. Use at agent startup to make all stored secrets available as env vars. |
| rotate_secretA | Re-encrypt a secret with a fresh Data Encryption Key. Use after KMS key rotation or as a security best practice. Requires Pro tier. |
| get_accountA | Get your account tier, secret usage, and limits. |
| share_secretA | Create a time-limited, read-only share link for a secret. Returns a shareToken that can be used to retrieve the secret without authentication. Requires Builder+ tier. |
| list_sharesA | List all active (non-revoked, non-expired) share links on the account. Requires Builder+ tier. |
| revoke_shareA | Revoke a share link immediately so it can no longer be used. Requires Builder+ tier. |
| get_shared_secretA | Retrieve a shared secret using a share token. No authentication required. The share must be non-expired, non-revoked, and within its read limit. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Every tool targets a distinct resource and action: secret CRUD, share lifecycle, account info, and environment injection. The similar-looking get_secret and get_shared_secret are clearly separated by authentication model and token/name input.
All tools follow a consistent snake_case verb_noun pattern, such as set_secret, list_shares, delete_secret, and revoke_share. This makes the toolset predictable and easy for an agent to navigate.
Eleven tools is well within the ideal range and each tool earns its place by covering a distinct secrets-management capability. There are no redundant or filler tools.
Secrets support create/update, read, versioned retrieval, delete, list, rotation, and environment injection. Shares support create, list, revoke, and anonymous retrieval, with account tier visibility, so the surface covers the full lifecycle with no obvious dead ends.