Secure Vault MCP server

by mdfifty50-boop·io.github.mdfifty50-boop/secure-vault·v0.1.1

No reviews yet

Encrypted secrets and credential management for agents

B78/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B78/100

full report

Adoption

New

0 stars39 downloads/wk

Reviews

Write one

Nobody has reviewed Secure Vault yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Secure Vault tools (7)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

audit_secret_access
View an audit trail of who accessed which secrets over a time range.
get_agent_token
Issue a short-lived, scoped token for an agent to use a secret. The agent receives an opaque token ID — never the raw secret. Use inject_secret_to_request to apply the token to an outbound request.
health_check
Returns server health, uptime, version, and call stats
inject_secret_to_request
Return a request object with the secret injected. Pass a token_id obtained from get_agent_token and a request template with a {{SECRET}} placeholder. The server substitutes the real secret — the agent never handles the raw value.
rotate_secrets
Rotate all secrets for a given service. Old values are overwritten, and all outstanding tokens for those secrets are invalidated.
scan_config_for_leaks
Scan a config text for exposed secrets — API keys, tokens, passwords, private keys. Uses 12 regex patterns covering AWS, GitHub, OpenAI, Anthropic, Slack, Stripe, and generic credentials.
store_secret
Store an encrypted secret with optional rotation policy. Value is encrypted at rest with AES-256-GCM.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan9 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 156 days ago8/15
Maintainer identityregistry namespace matches repository owner6/10

Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Secure Vault compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 78/100; higher than 57% of 48,255 servers
Tools: 7; the typical server has 7
Tools that change things: 0%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 39; more than 30% of 12,191 servers with a package

What its tools let an agent do: 7 read

Install Secure Vault in Claude Code, Cursor or VS Code

Runs npx -y secure-vault-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add secure-vault -- npx -y secure-vault-mcp

Add to Cursor

What the publisher says

From the Secure Vault repository's README, as published. We do not edit it. Read it on GitHub

secure-vault-mcp

MCP server for agent-native secrets management. 24,008 secrets have been found in MCP config files on public GitHub. This server solves that.

Agents need secrets to call APIs, but they shouldn't see raw values. secure-vault-mcp stores secrets encrypted with AES-256-GCM, issues short-lived scoped tokens, and injects secrets into requests server-side so the agent never handles plaintext credentials.

Install

npx secure-vault-mcp

Claude Desktop

Add to claudedesktopconfig.json:

{
  "mcpServers": {
    "secure-vault": {
      "command": "npx",
      "args": ["secure-vault-mcp"]
    }
  }
}

From source

git clone https://github.com/mdfifty50-boop/secure-vault-mcp.git
cd secure-vault-mcp
npm install
node src/index.js

Tools

store_secret

Store an encrypted secret with optional rotation policy.

getagenttoken

Issue a short-lived, scoped token. The agent receives an opaque token ID, never the raw secret.

rotate_secrets

Rotate all secrets for a service. Old tokens are invalidated.

auditsecretaccess

View who accessed what secrets over a time range.

scanconfigfor_leaks

Scan config text for exposed secrets. Detects AWS keys, GitHub tokens, OpenAI/Anthropic keys, Slack tokens, Stripe keys, private key blocks, bearer tokens, and generic credentials using 12 regex patterns.

injectsecretto_request

Return a request with the secret injected server-side. The agent provides a template with {{SECRET}} placeholder and a valid token ID.

Resources

Usage Pattern

1. store_secret — store credentials at setup time
2. get_agent_token — agent requests a scoped, time-limited token
3. inject_secret_to_request — inject secret into API call template
4. rotate_secrets — rotate when needed, old tokens auto-invalidate
5. scan_config_for_leaks — check config files before committing
6. audit_secret_access — review access trail

Security Model

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Secure Vault: common questions

Is Secure Vault MCP server safe?: Mostly: it is graded B (78/100). Read the Secure Vault safety report
How do I install Secure Vault?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Secure Vault need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Secure Vault maintained?: The last commit was 194 days ago (2026-04-24). The latest release is v0.1.1.
How does Secure Vault compare with other MCP servers?: safety score 78/100 (higher than 57% of 48,255 servers); tools 7 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.