MCP Secret Vault — Wundervault MCP Server for AI Agents

`vault_entries_list`

Lists the secrets this agent may use: name, id, and what kind of secret it is (web service, SSH, wallet or signing key). Never values.

`vault_call`

Calls a web service with a secret attached, and returns the answer with the secret removed.

entry_id: Which secret.
purpose: Why, in a sentence. Kept in the helper app’s log on the owner's computer.
request: origin (scheme: "https", host, port), method, path, and optional query, body and headers (your own, such as a user agent; never the one that carries the secret).
request.stamp: For a secret the owner marked "stamped" (AWS, X, exchanges): how the service signs requests. The secret itself never travels; the helper app computes the signature. {"builtin": "oauth1"} signs for X and other OAuth 1.0a services, with a fresh one-time code for every request. The owner approves each new recipe once.
operation_id + args: Instead of request: run an operation the owner defined for this secret.

The helper app attaches the secret the way the owner set for it: a header, a query parameter, a username and password, or part of the web address. Your agent never chooses that.
HTTPS only, with real certificate checks. Redirects are not followed.
Private network addresses are refused unless the owner allowed one for this secret.
Answers have size and time limits.
An "ask me first" secret waits until the owner approves that destination, method and path, once or for a short window.

`vault_ssh_exec`

Runs a command on a server, or copies files to it with rsync, with the helper app signing the SSH login.

entry_id: Which SSH key (ed25519).
destination: [user@]host. The host must be on the key's list of allowed hosts.
purpose: Why.
remote_argv: The command and its arguments, run without a shell.
rsync_args: Instead of a command: rsync arguments. Every host:path is checked against the same list.
timeout_seconds, working_dir: Default 120 seconds; local folder for rsync sources.

The key never leaves the helper app. A key with no allowed hosts can't be used, and naming another host inside the command doesn't change where it connects.

`vault_pay`

Pays when a service answers "402 Payment Required" (x402), from a wallet whose key stays with the helper app. Returns the header to send when you retry the same request.

entry_id: Which wallet.
payment_required: The 402 reply's PAYMENT-REQUIRED header, or its decoded JSON, or a version 1 402 body.
accept_index: Which offer to pay, when the service offers more than one.
purpose: Why. The owner sees it if they're asked.

USDC on Base and Solana, and their test networks.
Inside the owner's rules (payees they trust, a daily limit, networks they allow) it's signed at once. Anything else waits for the owner; if they haven't answered yet, call again with the same payment to keep waiting.

How payments work.

`vault_sign`

Signs data with a signing key whose value stays with the helper app. The owner approves every signature.

entry_id: Which signing key.
data: What to sign, at most 256 KB.
encoding: How data is written: utf8 (the default), base64 or hex.
purpose: What the signature is for. The owner sees it.

The owner is shown the data in full when it's text up to 64 KB, and its SHA-256 fingerprint always. Returns the signature (base64), the public key and the algorithm.

What errors mean

Waiting for approval: The owner is being asked. Nothing was sent.
Helper app not running: The helper app isn't installed on this computer, or this agent isn't enrolled.
Wrong kind of secret: For example, an SSH key used with vault_call, or a wallet with vault_sign.
Upgrade required: This MCP server is older than the helper app.

Version 1 tools that are gone

vault_exec, vault_entry_get, vault_entry_inject_env and vault_rsync handed the secret to a command your agent chose. Version 2 doesn't: use vault_call for web services, vault_ssh_exec, including its rsync_args, for servers, vault_pay for payments and vault_sign for signatures. How to upgrade.