Envault
Let agents fetch and rotate secrets from Envault while a human-in-the-loop gate blocks risky mutations.
Overview
io.github.DinanathDash/envault is an MCP server for the Ship phase that manages secrets through Envault with a Human-In-The-Loop interceptor for agent mutations.
What is this MCP server?
- Envault-backed secret management exposed as MCP tools for coding agents
- Human-In-The-Loop (HITL) interceptor on agent-driven mutations
- Requires ENVAULT_TOKEN (MCP token) and ENVAULT_BASE_URL (https://www.envault.tech)
- stdio npm package @dinanathdash/envault-mcp-server, version 1.12.0
- Reduces .env sprawl while keeping approval on sensitive changes
- Server version 1.12.0 on MCP schema 2025-12-11
- npm package @dinanathdash/envault-mcp-server, stdio transport
- Required env: ENVAULT_TOKEN (secret), ENVAULT_BASE_URL (https://www.envault.tech)
Community signal: 3 GitHub stars.
What problem does it solve?
Agents need API keys to ship, but handing them uncontrolled secret write access is reckless for a one-person team.
Who is it for?
Solo builders using Envault who want MCP agents to pull secrets safely and gate automated changes to vault data.
Skip if: Teams without an Envault account, offline-only .env workflows, or environments that ban cloud secret managers.
What do I get? / Deliverables
Secrets live in Envault, agents read what you allow, and risky mutations pause for human approval before they land.
- Agent-accessible secret reads from Envault without copying keys into chat
- HITL-gated path for vault mutations initiated by automation
- Centralized credential workflow aligned with ship-phase security checks
Recommended MCP Servers
Journey fit
How it compares
Envault-backed secrets MCP with HITL, not a local-only .env editor skill.
Common Questions / FAQ
Who is envault for?
Indie developers and small teams on envault.tech who wire Claude Code, Cursor, or similar MCP clients and need governed secret access for agents.
When should I use envault?
Use it during ship and security hardening when agents need production or staging credentials and you want human approval on vault mutations.
How do I add envault to my agent?
Create an MCP token in Envault Account Settings → Security, set ENVAULT_TOKEN and ENVAULT_BASE_URL=https://www.envault.tech in your MCP server env, install @dinanathdash/envault-mcp-server over stdio, and restart your host.