Login Vault MCP server

• audit_logFree

  Owner only. The last uses of your vault: who (bot label), which login, which domain, what happened. Never contains secrets.

• create_bot_keywrite actionFree

  Owner only. Make a per-bot key (vk_...) that can only open sessions on the logins you name. Shown once; we store only its hash. Revoke any time with revoke_bot_key.

• delete_loginwrite actionFree

  Owner only. Delete a saved login, end its open sessions and remove it from every bot key.

• end_sessionFree

  End a session now and wipe its cookies.

• list_loginsFree

  List saved logins (name, domain, scope, sessions today; never secrets). With your owner key it also lists bot keys. A bot key only sees the logins it was granted.

• open_sessionFree

  Sign in with a saved login without seeing it. The server fills {{username}}, {{password}} and {{totp}} into your form, posts it to url (https, inside the login's allowed hosts), keeps the cookies encrypted, and returns an opaque session id. Checked against the login's scope and daily cap; logged to the audit log. If the site shows a CAPTCHA or new-device check, the reply suggests next_step request_human (Human Handoff relay). Free watch-only logs would_use_vault and signs in nowhere.

• revoke_bot_keyFree

  Owner only. Revoke a bot key right away and end every session it opened.

• save_loginFree

  Owner only (your Pro key, never a bot key). Store one login sealed with AES-256-GCM, with a scope: allowed hosts, allowed methods, a daily session cap and session TTL. Run it from your own machine, not inside the bot. The password and TOTP secret are never returned by any tool. Free watch-only stores nothing and logs would_use_vault.

• session_fetchFree

  Make one request inside an open session. url must be https inside the login's allowed hosts and the method must be in its allowed methods. The password, TOTP secret and codes are redacted from the reply; cookies never leave the vault.

• usage_and_upgradeFree

  Show today's usage for your key or IP and the $9/month upgrade link. Free tier: 500 calls/day. Not metered.

• weekly_reportFree

  Plain-English summary of the last 7 days: where your bots needed to sign in (by domain), sessions opened, blocked attempts, by bot. Read-only. Needs a key.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 566ms20/20
• Tool poisoning11 tool descriptions checked15/15
• Auth qualityopen endpoint exposes 2 write-action tools with no auth3/15
• Maintenanceno repository listed3/15
• Maintainer identityverified namespace with website, no repo4/10

Safety score

60/100

higher than 15% of 48,255 servers

Tools

11

the typical server has 7

Tools that change things

18%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote server answers 100%

Response time

703 ms

faster than 19% of 30,031 servers

Login Vault: common questions

Is Login Vault MCP server safe?

With care: it is graded C, so read the findings first (60/100). Read the Login Vault safety report

How do I install Login Vault?

It runs remotely at vault.cloudforbots.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Login Vault need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Login Vault maintained?

The latest release is v1.0.0.

Is Login Vault up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

How does Login Vault compare with other MCP servers?

safety score 60/100 (higher than 15% of 48,255 servers); tools 11 (the typical server has 7); tools that change things 18% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.