Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@DevVault MCP Run my deployment script with the vault secrets"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Your AI can use your secrets. It can never read them.
DevVault is a local-first secrets vault that any MCP-aware client (Claude Desktop, Claude Code, Cursor, VS Code) can talk to. The AI assistant can store, list, rotate, and operate your secrets — but the plaintext values never enter the model's context, so a prompt-injection attack has nothing to steal.
AI agents now touch real infrastructure — they deploy, call APIs, run migrations. That means they need credentials. Today you have three bad options:
Paste the key into chat — it's now in a transcript, a log, maybe a training set.
Leave it in .env — plaintext on disk, one git add . away from a public repo.
Use an existing MCP vault — better, but they expose a getSecret tool that drops the plaintext into the model's context. The OWASP MCP Top 10 lists prompt injection as the #1 threat: a hidden instruction in a web page or README that the agent obeys. If the agent can read the secret, an injection can make it leak the secret.
DevVault removes the agent's ability to read the secret in the first place.
Analogy: a hotel safe where the bellhop (the AI) can carry the locked box to your room and use what's inside on your behalf — but can never open it. The combination stays with you.
Related MCP server: VaultBridge
MCP Client (Claude, Cursor)
│ sees: names, metadata, exit codes, REDACTED output
│ never sees: plaintext secret values
▼
DevVault MCP Server ──► Crypto core (AES-256-GCM, one IV per secret)
│ │ master key
▼ ▼
Child process ◄── secrets OS keychain (or passphrase fallback)
(npm deploy, injected as
curl, etc.) env varsThe one line that is the whole product: plaintext flows from the crypto core into the child process's environment, and never travels back up to the AI.
Tool | Can the AI see the value? | Notes |
| No (write-only) | Confirms by name; value never echoed. |
| No (metadata only) | Names, project, timestamps. |
| No (write-only) | Replaces a value in place. |
| No | Soft-delete (recoverable). |
| No — injected into child env | Returns exit code + redacted stdout/stderr. This is the headline feature. |
| Yes — escape hatch | Off by default. Only registers if you set |
Every call is recorded in a hash-chained, tamper-evident audit log (names + outcomes — never values).
npx devvault-mcpAdd to your Claude Desktop MCP config (claude_desktop_config.json):
{
"mcpServers": {
"devvault": {
"command": "npx",
"args": ["-y", "devvault-mcp"]
}
}
}Restart Claude Desktop. The DevVault tools will appear. Try: "Store my Stripe test key as STRIPE_KEY, then list my secrets."
On macOS / Windows / Linux with a desktop keychain, DevVault stores its master key there automatically. In headless environments (CI, containers) set a passphrase instead:
export DEVVAULT_PASSPHRASE="a-long-random-passphrase"The model is an untrusted operator. Every tool assumes the AI's context may be hijacked at any moment.
Plaintext has exactly one exit, and it isn't the model — the environment of a child process you asked to run.
Tools are risk-tiered. Safe tools never return values. getSecret is off by default. deleteSecret is soft + recoverable.
Every access is on the record — hash-chained audit log; alter one entry and the chain visibly breaks.
Fail closed. Wrong key, tampered data, unknown secret, corrupt vault → error, never a partial or plaintext fallback.
Note on concurrency: writes are serialized with an in-process lock so parallel calls can't clobber the vault file. DevVault does not impose ordering between two independent concurrent tool calls — an MCP client should await each tool's result before issuing the next (which is how the model behaves normally).
Crypto disclaimer: the encryption uses only Node's built-in
crypto(no hand-rolled primitives), but this code has not yet had an independent security review. Do not rely on it for high-value production secrets until that review is done (see the launch brief).
Env var | Purpose | Default |
| Vault file location |
|
| Master key fallback when no OS keychain | (none — keychain used) |
| Audit log location |
|
| Config file location |
|
To enable the getSecret escape hatch, create ~/.devvault/config.json:
{ "allowPlaintextReads": true }npm install
npm test # 19 tests incl. tamper, wrong-key, redaction, no-leak, concurrency
npm run buildApache-2.0. The free local vault is open source — that's the distribution engine, not lost revenue. Paid collaboration (encrypted team sync, audit export, policy) is the roadmap.
Soft-delete a secret (recoverable). The value is never returned.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses two important behaviors: the delete is recoverable (soft-delete) and the secret value is never returned. This goes beyond the name/title but could still mention permissions or error handling for a more complete picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences that are front-loaded with the core action. Every word adds value: the first sentence states what it does, the second adds an important behavioral constraint. There is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the primary purpose and a key constraint, but fails to provide context on when to use it, how recovery works, or how it relates to sibling operations like rotation. Given the simple parameter set and lack of annotations, the description is minimally adequate but leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter 'name' with a pattern, but no description. The tool description does not explain what 'name' refers to or any additional semantics beyond the schema's pattern. Since schema description coverage is 0%, the description needed to compensate but did not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'soft-delete' and identifies the resource as 'a secret', which clearly distinguishes it from sibling tools like listSecrets, storeSecret, rotateSecret, and runWithSecrets. The parenthetical '(recoverable)' adds meaningful differentiation from a permanent delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives like rotateSecret or runWithSecrets. It implies deletion use, but does not state explicit conditions, prerequisites, or situations where a different operation would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List secret names and metadata. Does NOT return secret values.
| Name | Required | Description | Default |
|---|---|---|---|
| project | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses a critical behavioral trait: it does not return secret values, which is important for a secrets management tool. However, it doesn't mention other behaviors like permissions, pagination, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, with the key information front-loaded. It conveys the core action and the most important caveat without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives the basic action and a key caveat, but it lacks details about the return structure and the project parameter. Given no output schema and no parameter guidance, the description is only minimally complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'project' parameter has no schema description, and the tool description doesn't mention it at all. Since schema coverage is 0%, the description fails to convey whether project is a filter, a required context, or its format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists secret names and metadata, with the explicit caveat that it does not return secret values. This distinguishes it from sibling tools that store, rotate, delete, or run with secrets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool or how it compares to alternatives. The only hint is the exclusion of secret values, implying it's not for retrieving values, but it doesn't name a sibling alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Replace a secret's value. The value is never returned.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| value | Yes | ||
| project | No | default |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided. The description discloses that the value is never returned, which is important security context, but it does not mention behavior for non-existent secrets, permissions, or what response to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler, but it omits parameter details and usage context, making it efficient yet under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 3 parameters and no output schema, the description lacks essential operational details like error conditions, success indicators, and when rotation is applicable compared to storeSecret.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description only mentions 'value' indirectly, with no explanation of 'name', 'project', or how they relate to the operation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Replace' and identifies the resource 'secret's value', clearly distinguishing from siblings like storeSecret (store) and deleteSecret (delete).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for changing an existing secret's value but does not explicitly state when to use it versus storeSecret or provide any prerequisites or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a command with named secrets injected as environment variables into the child process. Returns exit code and REDACTED output. Secret values are never exposed to the model.
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | ||
| command | Yes | ||
| secretNames | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and discloses key behaviors: redacted output, exit code, and that secret values are never exposed to the model. This is critical security context. It does not cover error handling or environment details, but the core transparency is strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no redundancy: purpose, output, and security guarantee. Each sentence adds distinct value, and the core action is front-loaded. This is efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description covers the essential behavior and safety promise. It omits details like failure modes or how secrets map to environment variable names, but an agent has enough to select and invoke it correctly. Slightly above average due to the security-focused completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds meaning for 'secretNames' by explaining they are injected as environment variables, and 'command' is self-evident. However, it does not mention 'args' at all, leaving that parameter undocumented. The description partially compensates but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('run'), clearly identifies the resource ('command with named secrets'), and distinguishes itself from sibling secret-management tools by focusing on execution with injected secrets. It also states the output behavior (exit code, redacted output), making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: use this when you need to run a command with secrets without exposing them. It does not explicitly name alternatives or when-not-to-use, but the security guarantee ('never exposed to the model') suggests it is the safe choice over manually retrieving secrets. This is clear context without explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Encrypt and store a secret value. The value is never returned.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| value | Yes | ||
| project | No | default |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds one useful detail ('The value is never returned') but omits critical traits such as overwrite behavior, error handling, permissions required, or whether the operation is idempotent. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two short sentences that each add value. It front-loads the core action and appends a key behavioral note, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations, output schema, and parameter descriptions, the description is under-specified. It does not clarify whether storing an existing name overwrites or errors, how the 'project' parameter affects behavior, or what a successful call returns (beyond noting the value itself is never returned). This leaves significant gaps for safe usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the parameters (name, value, project). It neither lists them nor describes their meaning, leaving the agent to rely solely on schema constraints like the name pattern and value minLength, which is not enough.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Encrypt and store a secret value.' It uses a specific verb ('store') and resource ('secret value'), and explicitly notes that the value is never returned, which distinguishes it from sibling tools like listSecrets and runWithSecrets.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like rotateSecret or deleteSecret. There is no mention of prerequisites, exclusions, or appropriate use cases, leaving the agent to infer based on the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0deleteSecretlistSecretsrotateSecretrunWithSecretsstoreSecretEach tool targets a distinct operation: listing, storing, rotating, deleting, and running with secrets. There is no overlap in purpose, and the descriptions reinforce the boundaries (e.g., listSecrets never returns values, runWithSecrets only injects them).
All tool names follow a consistent camelCase verb_noun pattern (listSecrets, storeSecret, rotateSecret, deleteSecret, runWithSecrets). The verb prefix clearly indicates the action, and the noun 'Secret' is consistent throughout.
Five tools is well-scoped for a secrets management server, covering the core lifecycle and usage without unnecessary bloat. Each tool earns its place, and the count is within the ideal 3-15 range.
The toolset provides complete coverage for the domain: create (storeSecret), read metadata (listSecrets), update (rotateSecret), delete (deleteSecret), and usage (runWithSecrets). The intentional omission of returning secret values is by design and does not leave a functional gap.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
A secret store for AI agents: the agent never sees the plaintext.
Persistent memory for AI assistants — one shared, OAuth-secured vault for every MCP client.
Secrets for developers and agents—secure context and workflows without exposing secret values.
Encrypted secret store and rotation for autonomous agent credentials
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ConjureGanja/devvault-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
