@vaultmcp-axiler/cli

Fetch shared VaultMCP workspace secrets and run local commands with them injected into the process environment. Rotate secrets in the dashboard; teammates pick up new values on the next vaultmcp run.

Docs: vaultmcp.space/docs#local-env

Install

npx @vaultmcp-axiler/cli@latest --help
# or install globally:
npm i -g @vaultmcp-axiler/cli

Requires Node.js 22+.

Setup

1. In VaultMCP, store team secrets as workspace (shared) visibility.
2. Create a personal access token with the Runtime env (CLI) preset (env scope only). MCP read/write tokens are for /mcp IDE clients — they are not interchangeable with env PATs.
3. Point the CLI at your API origin (not the /mcp URL):

npx @vaultmcp-axiler/cli@latest login --token vmcp_… --url https://vaultmcp.space
npx @vaultmcp-axiler/cli@latest run -w your-slug -- npm run dev

Optional env overrides (preferred for CI / one-offs; skip writing ~/.config/vaultmcp/config.json):

export VAULTMCP_URL=https://vaultmcp.space
export VAULTMCP_TOKEN=vmcp_…
npx @vaultmcp-axiler/cli@latest run -w your-slug --names DATABASE_URL,GITHUB_TOKEN -- npm run dev

Commands

| Command | Purpose | |---------|---------| | vaultmcp login --token … --url … | Save credentials to ~/.config/vaultmcp/config.json (mode 0600) | | vaultmcp run -w <slug> [--names A,B] -- <cmd> | Fetch secrets, merge into child env, run command (preferred) | | vaultmcp env -w <slug> [--format json\|dotenv] | Print secrets to stdout — prefer run; do not commit the output |

Security

• Runtime export returns plaintext to your machine (unlike MCP tool injection). Use short-lived env-only tokens; revoke on offboarding.
• Prefer run over env and over writing .env files — secrets stay in the child process only.
• Use HTTPS except for localhost.
• Server API: GET /api/runtime/v1/env (Bearer vmcp_… with env scope).

License

AGPL-3.0-only