@intellica/vault-mcp

MCP server that lets LLMs execute code using secrets without seeing secret values.

How It Works

1. You store secrets in a secure vault (OS keychain or encrypted file)
2. LLM writes normal Node.js code using process.env.SECRET_NAME
3. LLM submits code via MCP tool call
4. vault-mcp executes in isolated process, injects secrets, sanitizes output
5. LLM receives clean output — secret values replaced with [REDACTED]

Quick Start

npx @intellica/vault-mcp init
npx @intellica/vault-mcp add STRIPE_KEY --type api_key

Add to your MCP client config:

{
  "mcpServers": {
    "vault": {
      "command": "npx",
      "args": ["@intellica/vault-mcp", "serve"]
    }
  }
}

Secret Types

| Type | Usage | Example | |------|-------|---------| | api_key | API keys and service credentials | vault-mcp add STRIPE_KEY --type api_key --desc "Stripe secret key" | | db_connection | Database connection strings (password auto-redacted) | vault-mcp add DB_MAIN --type db_connection --desc "Production PostgreSQL" | | token | Auth tokens, JWT secrets, session tokens | vault-mcp add JWT_SECRET --type token --desc "JWT signing secret" | | password | Plain passwords | vault-mcp add ADMIN_PASS --type password --desc "Admin panel password" | | connection_string | Non-DB connection strings (Redis, AMQP, etc.) | vault-mcp add REDIS_URL --type connection_string --desc "Redis cache" | | custom | Anything else (default) | vault-mcp add MY_SECRET --type custom --desc "Custom secret" |

db_connection type has special handling: the sanitizer parses the connection string and individually redacts password components, even if they appear separately in output.

CLI Commands

| Command | Description | |---------|-------------| | vault-mcp init | Initialize project | | vault-mcp add <name> | Add secret (masked input) | | vault-mcp remove <name> | Remove secret | | vault-mcp list | List secrets (names only) | | vault-mcp run <file> | Run script with secrets (manual use) | | vault-mcp serve | Start MCP server | | vault-mcp doctor | Check health |

MCP Tools

| Tool | Description | |------|-------------| | vault_execute | Run code with secrets in isolated process | | vault_list_secrets | List secret metadata (never values) | | vault_secret_info | Get single secret metadata | | vault_health | Server health check |

Security

• Secret values never enter LLM context
• Output sanitized across multiple encodings (direct, base64, URL-encoded)
• Code validated for dangerous patterns before execution
• Child process runs with clean environment (only requested secrets)
• Vault encrypted at rest (OS keychain or AES-256-GCM)

License

MIT