MCP Secrets Vault sits between an AI assistant (Claude Desktop or any MCP-compatible client) and the secret store. When the assistant needs to call an API, it invokes a vault tool by name; the server resolves the secret from environment variables, injects it into the request, and returns only the sanitized response; the raw secret value never appears in the model context. Policy-based access control, configurable rate limiting, and an audit log are built in. The package is MIT-licensed, published on npm, and ships with CI coverage badges and a demo walkthrough.
MCP Secrets Vault: AI-Safe Secret Management
3 built-in controls
MIT license
npm published
01What it is
A published npm MCP server that lets AI assistants use secrets (API keys, tokens, credentials) to perform authorized actions without ever exposing the secret values.
02Engineering
03 Architecture
Client
Claude DesktopMCP-compatible client
Tool invocation
vault tool by name
Secret resolution
environment variablesinject into request
Controls
policy-based access controlconfigurable rate limitingaudit log
Response
sanitized response
04 Highlights
- Sits between an AI assistant (Claude Desktop or any MCP-compatible client) and the secret store, invoked as a vault tool by name
- Resolves the secret from environment variables, injects it into the request, and returns only the sanitized response
- The raw secret value never appears in the model context
- Policy-based access control, configurable rate limiting, and an audit log are built in
05Stack
TypeScriptMCP SDKZodVitestGitHub Actions
06Status
shipped