List the vault entries this agent may use. For each: its ID, name, tier, what kind of secret it is — web-service (vault_call), SSH (vault_ssh_exec), wallet (vault_pay) or signing key (vault_sign) — and any signed operations it offers. Never a secret's value — no tool returns one.

Call a web service with a vaulted secret that is never returned to you: the broker attaches the secret, sends the request and gives you the answer with the secret removed.

Two ways to call. Describe the request yourself with request (origin, method, path, and optional query, body and your own headers). Or run a named operation the owner defined, with operation_id and typed args: the operation fixes the origin and route, returns only the fields it permits, and is signed with a key derived from the secret itself, so a definition altered in transit is refused. vault_entries_list shows which operations an entry offers.

Either way the entry decides how the secret is attached (a header, a query parameter, a username and password, or part of the web address) — you never choose that, and never see the secret.

Pay an x402 "402 Payment Required" from a vaulted wallet whose key is never returned to you. Pass the 402 reply's PAYMENT-REQUIRED header (or the decoded JSON, or a v1 402 body) as payment_required; you get back the header to send when you retry the same request. USDC only, on Base, Base Sepolia, Solana and Solana devnet. Payments inside the owner's rules (allowed payees, a daily limit) are signed at once; anything else waits for the owner to approve, and if they have not answered yet, call again with the same payment to keep waiting.

Sign data with a vaulted signing key whose value is never returned to you. Every signature is approved by the owner, who is shown the data (in full when it is text up to 64 KiB) and its sha256. Returns the signature (base64), the public key and the algorithm. At most 256 KiB.

Run a command on a remote host, or rsync files to it, using a vaulted SSH key that is never written to disk and never returned to you.

The key stays inside the broker, which answers signature requests over a private ssh-agent socket that exists only for the duration of this call. You choose the remote command; you do not get the key.

The destination is checked against the ssh_hosts allowlist on the entry, and the ssh command line is constructed here — naming a different host inside remote_argv does not change where it connects. An entry with no ssh_hosts authorises nothing.

Every signature is audited with the key fingerprint and the authorised host.