vaulted-fyi/vaulted-mcp-server

Share encrypted, self-destructing secrets directly from Claude Desktop, Cursor, Windsurf, and any MCP-compatible AI tool.
- 🔒 Zero-knowledge E2E encryption (AES-256-GCM, key never sent to server)
- 🙈 Agent-blind input: share env vars, files, and .env keys without exposing them in context
- 🛠️ 4 tools: create_secret, view_secret, check_status, list_secrets
- 📋 Local history with live status tracking
- 💻 Works with Claude Desktop, Cursor, Windsurf, Claude Code, VS Code
Agent-blind secret sharing
The headline feature: sensitive values are **resolved locally and never passed through the LLM**. When you ask your agent to share an environment variable or file, the MCP server reads the value directly from your machine — the agent only ever sees the secure link, not the secret itself.
This means sensitive values never appear in your conversation history or the LLM's context.
Installation
**Requires Node.js ≥ 18.**
Zero-install via npx:
Or install globally:
Quick start
Add to your MCP host config and restart the application. Your agent will have access to all 4 Vaulted tools immediately.
Configuration
Claude Desktop
File: ~/Library/Application Support/Claude/claude_desktop_config.json
Cursor
File: ~/.cursor/mcp.json
Windsurf
File: ~/.codeium/windsurf/mcp_config.json
Claude Code
File: .mcp.json in your project root (or ~/.claude/.mcp.json globally):
VS Code
File: .vscode/mcp.json
Any other MCP client
Run npx @vaulted/mcp-server as a stdio transport. The server uses the standard MCP stdio protocol.
Optional flags
| Flag | Default | Description |
| ---------------- | --------------------- | --------------------------------------------------------------------------------- |
| --base-url | https://vaulted.fyi | Vaulted API base URL (for self-hosted instances) |
| --allowed-dirs | _(none)_ | Comma-separated directories accessible for file-based input sources (extends CWD) |
Pass flags via the args array:
Multiple allowed directories:
Tools reference
create_secret
Encrypt and store a secret, returns a shareable self-destructing link.
| Parameter | Type | Default | Description |
| ------------ | ------------------------------------------------------------------------------------------ | -------- | ---------------------------------------------------------------------------------------------------- |
| content | string | required | The secret to encrypt (max 1000 chars). Supports agent-blind prefixes. |
| max_views | "1" \| "3" \| "5" \| "10" | "1" | Views before self-destruct |
| expiry | "1h" \| "2h" \| "6h" \| "12h" \| "24h" \| "3d" \| "7d" \| "14d" \| "30d" | "24h" | Time until expiration |
| passphrase | string | _(none)_ | Optional passphrase protection |
| label | string | _(none)_ | Human-readable label for local history |
**Returns:** { success: true, data: { url, statusUrl, expiresIn, maxViews, passphraseProtected }, message }
---
view_secret
Retrieve and decrypt a secret from a Vaulted URL. Defaults to opening in the browser — use output_mode to keep the decrypted value out of the conversation.
| Parameter | Type | Default | Description |
| ---------------- | ------------------------------------------------------ | ------------------ | ------------------------------------------------------------ |
| url | string | _(one req.)_ | Full Vaulted URL including the # fragment |
| secret_id | string | _(one req.)_ | Secret ID (alternative to url) |
| encryption_key | string | _(with secret_id)_ | Encryption key from URL fragment (required with secret_id) |
| output_mode | "browser" \| "clipboard" \| "file" \| "direct" | "browser" | Where to send the decrypted value |
| file_path | string | _(none)_ | Required when output_mode is "file" |