@dinanathdash/envault-mcp-server

Envault MCP Server

This MCP server exposes Envault read + mutation tooling for MCP clients (Claude Desktop, VS Code, etc).

0) Generate an ENVAULT_TOKEN (do this first)

The MCP registry is a static phonebook. There is no onboarding UX and no safety net. If you skip this step, the server will start but every tool call will fail with 401 Unauthorized.

• Sign in to Envault.
• Open Account Settings → Security.
• Create a new MCP Token.
• Copy the full unmasked token value (you won’t be able to see it again).
• Use it as ENVAULT_TOKEN in your MCP client config (examples below).

Notes:

• Cloud ENVAULT_BASE_URL is https://www.envault.tech (recommended default).
• If you rotate/revoke the token, you must update the MCP config and fully restart your MCP client.

1) Configure your MCP client (copy/paste)

Claude Desktop (claude_desktop_config.json)

Use npx -y @dinanathdash/envault-mcp-server@latest:

{
  "mcpServers": {
    "envault": {
      "command": "npx",
      "args": ["-y", "@dinanathdash/envault-mcp-server@latest"],
      "env": {
        "ENVAULT_TOKEN": "envault_at_REPLACE_ME",
        "ENVAULT_BASE_URL": "https://www.envault.tech"
      }
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "envault": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@dinanathdash/envault-mcp-server@latest"],
      "env": {
        "ENVAULT_TOKEN": "envault_at_REPLACE_ME",
        "ENVAULT_BASE_URL": "https://www.envault.tech"
      }
    }
  },
  "inputs": []
}

Troubleshooting:

• spawn npx ENOENT in GUI apps usually means your GUI PATH is incomplete. Use an absolute npx path (or npx.cmd on Windows).
• 401 Unauthorized almost always means ENVAULT_TOKEN is missing/expired/revoked/masked or ENVAULT_BASE_URL doesn’t match where the token was issued.

Security model (HITL is non-bypassable)

• ENVAULT_TOKEN is only used to mint a short-lived delegated envault_agt_... agent token.
• All mutation tools (envault_push, envault_deploy, and autoPush flows) go through the HITL pipeline (/api/sdk/secrets) and return a pending approval (202 with approval_id/approval_url).
• No secrets are written until a human approves via envault_approve (or the dashboard approval UI).

Tools

• envault_status
• envault_context
• envault_pull
• envault_push
• envault_deploy
• envault_approve
• envault_diff
• envault_run
• envault_login
• envault_init
• envault_generate_hooks
• envault_audit
• envault_env_map
• envault_env_unmap
• envault_env_default
• envault_mcp_install
• envault_mcp_update
• envault_sdk_install
• envault_sdk_update
• envault_doctor
• envault_version
• envault_set_local_key
• envault_remove_local_key

Local setup

• Install dependencies:

cd mcp-server
npm install

• Configure standalone MCP auth:

export ENVAULT_TOKEN=envault_at_xxx
export ENVAULT_BASE_URL=https://www.envault.tech

• Optional: install/authenticate Envault CLI if you want CLI-dependent tools (envault_run, envault_login, envault_init, envault_generate_hooks, envault_audit, envault_env_*, envault_mcp_*, envault_sdk_*, envault_doctor, envault_version):

envault login
envault status

• Start server:

npm start

Core tools work without CLI when ENVAULT_TOKEN is set: envault_status, envault_context, envault_pull, envault_push, envault_deploy, envault_approve, envault_diff, plus autoPush for local key set/remove helpers.

Version and update commands

Check installed MCP server version:

envault-mcp-server --version
# or inside this folder
npm run version

Check whether an npm update is available:

envault-mcp-server --check-update
# or inside this folder
npm run check:update

Update to latest package version:

# Preferred (updates generated MCP configs to latest runtime setup)
envault mcp update

# npm fallback for standalone global package installs
npm install -g @dinanathdash/envault-mcp-server@latest

Installation options for end users

You have 3 practical distribution models:

• Local path (no publish required)

• Ship this repo (or this folder) and point MCP client to local file path.

• npm package (recommended for broad adoption)

• Publish this package and let users configure MCP with npx.
• This is the simplest install UX for most LLM clients.

• Source install from GitHub

• Users clone repo and run from local checkout.

Recommended MCP config after npm publish

See the copy/paste configs at the top of this README.

If you install locally in a workspace (npm install @dinanathdash/envault-mcp-server):

{
  "mcpServers": {
    "envault": {
      "command": "node",
      "args": ["node_modules/@dinanathdash/envault-mcp-server/server.mjs"]
    }
  }
}

Using npx (Requires Shell PATH)

{
  "mcpServers": {
    "envault": {
      "command": "npx",
      "args": ["-y", "@dinanathdash/envault-mcp-server"],
      "cwd": "/absolute/path/to/your/project"
    }
  }
}

Note: Using npx directly in MCP configuration often fails on Windows (requires npx.cmd) and macOS GUI apps due to missing shell environment variables.

MCP config for local repo path

{
  "mcpServers": {
    "envault": {
      "command": "node",
      "args": ["/absolute/path/to/Envault/mcp-server/server.mjs"],
      "cwd": "/absolute/path/to/your/project"
    }
  }
}

Behavior

• For "set key" workflows, use envault_set_local_key then envault_push (or set autoPush=true).
• Approval workflows are fully inline using envault_approve.
• Local env file resolution reads envault.json mappings and default environment.