@vaulted/mcp-server

Share encrypted, self-destructing secrets directly from Claude Desktop, Cursor, Windsurf, and any MCP-compatible AI tool.

• 🔒 Zero-knowledge E2E encryption (AES-256-GCM, key never sent to server)
• 🙈 Agent-blind input: share env vars, files, and .env keys without exposing them in context
• 🛠️ 4 tools: create_secret, view_secret, check_status, list_secrets
• 📋 Local history with live status tracking
• 💻 Works with Claude Desktop, Cursor, Windsurf, Claude Code, VS Code

Agent-blind secret sharing

The headline feature: sensitive values are resolved locally and never passed through the LLM. When you ask your agent to share an environment variable or file, the MCP server reads the value directly from your machine — the agent only ever sees the secure link, not the secret itself.

"Share the value of my STRIPE_SECRET_KEY env var"
→ Agent passes: env:STRIPE_SECRET_KEY  (never sees the value)
→ Server resolves it locally, encrypts, returns the link

This means sensitive values never appear in your conversation history or the LLM's context.

Installation

Requires Node.js ≥ 18.

Zero-install via npx:

npx -y @vaulted/mcp-server

Or install globally:

npm install -g @vaulted/mcp-server
vaulted-mcp-server

Quick start

Add to your MCP host config and restart the application. Your agent will have access to all 4 Vaulted tools immediately.

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

Configuration

Claude Desktop

File: ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

Cursor

File: ~/.cursor/mcp.json

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

Windsurf

File: ~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

Claude Code

File: .mcp.json in your project root (or ~/.claude/.mcp.json globally):

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

VS Code

File: .vscode/mcp.json

{
  "servers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server"]
    }
  }
}

Any other MCP client

Run npx @vaulted/mcp-server as a stdio transport. The server uses the standard MCP stdio protocol.

Optional flags

Pass flags via the args array:

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server", "--base-url", "https://your-instance.example.com"]
    }
  }
}

Multiple allowed directories:

{
  "mcpServers": {
    "vaulted": {
      "command": "npx",
      "args": ["-y", "@vaulted/mcp-server", "--allowed-dirs", "/home/user/secrets,/tmp/creds"]
    }
  }
}

Tools reference

create_secret

Encrypt and store a secret, returns a shareable self-destructing link.

Returns: { success: true, data: { url, statusUrl, expiresIn, maxViews, passphraseProtected }, message }

view_secret

Retrieve and decrypt a secret from a Vaulted URL. Defaults to opening in the browser — use output_mode to keep the decrypted value out of the conversation.

Output modes:

• browser — opens the secret URL in your default browser (decryption happens in-browser, value stays out of agent context)
• clipboard — copies decrypted value to clipboard, nothing returned to agent
• file — writes decrypted value to file_path, nothing returned to agent
• direct — returns decrypted value in the response (use with care — value enters agent context)

Returns: Depends on output_mode. Browser/clipboard/file modes confirm success without returning the plaintext.

check_status

Check how many times a secret has been viewed and whether it's still active. Does not consume a view.

Returns: { success: true, data: { views, maxViews, status, expiresAt }, message }

list_secrets

Show all locally tracked secrets with their live status fetched from the API.

Returns: { success: true, data: { entries: [...], suggestedAction? }, message }

suggestedAction is included when unconsumed active secrets exist, prompting you to use check_status to monitor them.

Response format

All tools use a consistent response shape:

// Success
{ "success": true, "data": { /* tool-specific */ }, "message": "Human-readable summary" }

// Error
{ "success": false, "error": { "code": "SECRET_EXPIRED", "message": "...", "suggestion": "..." } }

Error codes: SECRET_EXPIRED, SECRET_CONSUMED, PASSPHRASE_REQUIRED, ENV_VAR_NOT_FOUND, FILE_NOT_FOUND, PATH_TRAVERSAL_BLOCKED, DOTENV_KEY_NOT_FOUND, API_UNREACHABLE, API_ERROR, ENCRYPTION_FAILED, FILE_WRITE_ERROR, INVALID_INPUT

Examples

Create a secret