chillai-vault-mcp
Advanced tools
MCP server for credential isolation in LLM agents — bots use passwords without seeing them
MCP server for credential isolation in LLM agents. Your bot uses passwords and API keys — but never sees them.
Without Vault MCP With Vault MCP
User → "password: MyP@ss!" → LLM User → ●●●●●● → Vault → encrypted disk
LLM → vault_login("jira") → Vault → Chrome
LLM now has your password LLM sees only { status: "ok" }
in context, logs, history Password never enters LLM context
AI agents are getting real access to real systems. They log into websites, call APIs, manage infrastructure. The standard pattern is dangerous:
"Here's my Stripe key: sk-live-abc123, please check my charges"
That API key is now in the LLM's context window, conversation logs, provider's training pipeline (maybe), and any tool that reads the conversation. One leaked prompt — and your credentials are exposed.
Vault MCP solves this with a simple principle: the agent operates credentials, but never sees them.
┌─────────────────────────────────────────────────────────────┐
│ │
│ Credential lifecycle │
│ │
│ User types password │
│ │ │
│ ▼ │
│ ┌───────────┐ AES-256-GCM ┌───────────────┐ │
│ │ Browser │ ──────────────────► │ Encrypted │ │
│ │ form │ │ store (.json) │ │
│ └───────────┘ └───────┬───────┘ │
│ │ │
│ LLM calls vault_login() │ │
│ │ │ │
│ ▼ ▼ │
│ ┌───────────┐ ┌───────────┐ │
│ │ Vault MCP │ ◄────── │ Decrypt │ │
│ │ server │ │ in memory │ │
│ └─────┬─────┘ └───────────┘ │
│ │ │
│ ▼ │
│ ┌───────────┐ │
│ │ Chrome │ Fill form via CDP │
│ │ DevTools │ Password in browser only │
│ └─────┬─────┘ │
│ │ │
│ ▼ │
│ { status: "ok" } ◄── only this goes │
│ back to LLM │
│ │
└─────────────────────────────────────────────────────────────┘
5 MCP tools. The agent calls them like any tool. The difference — credential data never appears in the response.
| Tool | Agent calls | Agent sees | What actually happens |
|---|---|---|---|
vault_add | vault_add("jira") | { status, site_id } | Browser form opens, user enters password, encrypted to disk |
vault_login | vault_login("jira") | { status, page_title } | Decrypt, fill login form via Chrome CDP, clear password field |
vault_api_request | vault_api_request("stripe", url) | { status, body } | Decrypt API key, inject into headers, sanitize response |
vault_list | vault_list() | [{ siteId, type }] | List credential metadata — no secrets |
vault_status | vault_status("jira") | { active, lastUsed } | Metadata + audit count — no secrets |
The agent needs credentials it doesn't have. It asks the user to add them via a secure form — then logs in via Chrome.
User AI Agent Vault MCP Chrome
│ │ │ │
│ "Log me into │ │ │
│ Jira" │ │ │
├───────────────────►│ │ │
│ │── vault_list() ────►│ │
│ │◄── [] (empty) ─────┤ │
│ │ │ │
│ │── vault_add ───────►│ │
│ │ ("jira") │ │
│ │ │ │
│ ┌────────────────────────────┐ │ │
│ │ Browser form opens │ │ │
│ │ localhost:9900/add │ │ │
│ │ │ │ │
│ │ Email: [me@work.com] │ │ │
│ │ Password: [●●●●●●●●●●] │ │ │
│ │ URL: [jira.com] │ │ │
│ │ │ │ │
│ │ [Add to Vault] │ │ │
│ └────────────┬───────────────┘ │ │
│ │ │ │
│ └── POST ────────────────►│── encrypt │
│ │── save to disk │
│ │◄─ { status: ok } ───┤ │
│ │ │ │
│ │ Password is NOT │ │
│ │ in this response │ │
│ │ │ │
│ │── vault_login ─────►│── decrypt ──┐ │
│ │ ("jira") │◄────────────┘ │
│ │ │── fill email ────►│
│ │ │── fill pass ────►│
│ │ │── click submit ──►│
│ │ │── clear pass ───►│
│ │ │◄─ page loaded ───┤
│ │◄─ { status: ok, ───┤ │
│ │ title: "Jira" } │ │
│ │ │ │
│◄── "You're logged │ │ │
│ into Jira!" │ │ │
The agent makes API calls. Vault injects the key into headers and scrubs it from the response.
AI Agent Vault MCP Stripe API
│ │ │
│── vault_api_request ►│ │
│ service: "stripe" │── decrypt API key │
│ url: "/v1/charges" │ │
│ │── GET /v1/charges ────────►│
│ │ Authorization: │
│ │ Bearer sk-live-**** │
│ │◄── { data: [...] } ───────┤
│ │ │
│ │── scan response for │
│ │ leaked key │
│ │ (replace with ***) │
│ │ │
│◄── { status: ok, ───┤ │
│ body: "..." } │ │
│ │ │
│ API key NOT in │ │
│ this response │ │
Credentials already stored — the agent goes straight to login:
User AI Agent Vault MCP Chrome
│ │ │ │
│ "Open GitHub" │ │ │
├───────────────────►│ │ │
│ │── vault_list() ────►│ │
│ │◄─ [{ siteId: ─┤ │
│ │ "github", │ │
│ │ active: true }] │ │
│ │ │ │
│ │── vault_login ─────►│── decrypt ───┐ │
│ │ ("github") │◄─────────────┘ │
│ │ │── CDP login ─────►│
│ │ │◄─ success ───────┤
│ │◄─ { status: ok } ───┤ │
│ │ │ │
│◄── "Done!" │ │ │
Remove access — the agent can no longer use the credential:
Admin (CLI) Vault MCP AI Agent
│ │ │
│── vault-mcp remove │ │
│ "jira" │── delete + audit log │
│◄── "Removed" │ │
│ │ │
│ │ ... later ... │
│ │ │
│ │◄── vault_login ──────┤
│ │ ("jira") │
│ │── { FAIL: ──►│
│ │ "not found" } │
Every credential use is logged with a SHA-256 hash chain:
~/.vault-mcp/audit.jsonl
┌─────────────────────────────────────────────────────────────┐
│ evt_001 │ credential.created │ jira │ success │ hash_1 │
│ │ │ │ │ │ │
│ evt_002 │ credential.used │ jira │ success │ ▼ │
│ │ bot: claude │ │ prevHash: hash_1 │
│ │ │ │ │ hash_2 │
│ │ │ │ │ │ │
│ evt_003 │ credential.used │ jira │ success │ ▼ │
│ │ bot: claude │ │ prevHash: hash_2 │
│ │ │ │ │ hash_3 │
└─────────────────────────────────────────────────────────────┘
Tamper with any entry → chain breaks → detected
$ vault-mcp audit
Chain integrity: VALID (3 entries)
For browser-based AI chats, the credential form appears inline — no new tab:
Web Chat (browser) Vault MCP (server)
┌──────────────────────┐ ┌──────────────────┐
│ import { VaultUI } │◄══ WS ═════►│ WebSocket :9901 │
│ from 'vault-mcp/web'│ │ │
│ │ │ AI agent calls │
│ ┌────────────────┐ │◄── event ───│ vault_add() │
│ │ 🔒 Vault │ │ │ │
│ │ Password: ●●●● │ │ │ │
│ │ [Grant Access] │ │── POST ────►│ encrypt + save │
│ └────────────────┘ │ │ │
└──────────────────────┘ └──────────────────┘
Password goes via HTTP POST (not WebSocket).
WebSocket is only for signaling "credential needed" / "credential saved".
# Clone and build
git clone https://github.com/Chill-AI-Space/vault-mcp.git
cd vault-mcp && npm install && npm run build
# Register with Claude Code
claude mcp add -s user vault -- node ~/vault-mcp/dist/index.js
# Use: "Log me into GitHub"
# → vault_add("github") → browser form → you enter password
# → vault_login("github") → Chrome logs in
# → Agent sees { status: "ok" } — never the password
Or add credentials via CLI:
vault-mcp add --site github --email you@example.com --url https://github.com/login
# Password is prompted interactively (masked with *)
import { VaultUI } from 'vault-mcp/web';
const vault = new VaultUI({
vaultUrl: 'http://localhost:9900', // default
wsUrl: 'ws://localhost:9901', // default
onRequest: (siteId) => console.log(`Credential needed: ${siteId}`),
onSaved: (siteId) => console.log(`Saved: ${siteId}`),
});
vault.connect();
// When AI agent calls vault_add() → modal appears in your page
// No new browser tab. Password submitted via HTTP POST to vault.
Also works as a script tag:
<script type="module">
import { VaultUI } from './node_modules/vault-mcp/dist/web/vault-ui.js';
new VaultUI().connect();
</script>
Bundle size: ~6KB, zero runtime dependencies, Shadow DOM (no CSS conflicts).
vault-mcp add # Interactive credential entry
vault-mcp list # List credentials (no secrets)
vault-mcp remove <site_id> # Remove credential
vault-mcp audit [site_id] # Audit log + chain integrity
vault-mcp dashboard # Web dashboard on localhost:9900
vault-mcp/
├── src/
│ ├── index.ts ── CLI or MCP mode (auto-detect)
│ ├── server.ts ── MCP server with 5 tools
│ ├── cli.ts ── CLI commands
│ ├── tools/
│ │ ├── vault-add.ts ── Browser form OR WebSocket modal
│ │ ├── vault-login.ts ── Decrypt → Chrome CDP → fill form
│ │ ├── vault-api.ts ── Decrypt → inject headers → sanitize
│ │ ├── vault-list.ts ── Metadata only
│ │ └── vault-status.ts ── Metadata + audit stats
│ ├── ws/
│ │ └── server.ts ── WebSocket server (127.0.0.1:9901)
│ ├── web/
│ │ ├── vault-ui.ts ── Web SDK (WS client + modal)
│ │ └── modal.ts ── Shadow DOM modal (dark theme)
│ ├── store/
│ │ ├── encrypted-store.ts ── AES-256-GCM, unique IV per credential
│ │ └── keychain.ts ── Master key management
│ ├── browser/
│ │ └── cdp-bridge.ts ── Playwright CDP bridge
│ ├── audit/
│ │ └── logger.ts ── JSONL + SHA-256 hash chain
│ └── dashboard/
│ ├── server.ts ── HTTP + WS bootstrap
│ ├── index.html ── Dashboard UI
│ └── add.html ── Credential entry form
├── dist/web/
│ └── vault-ui.js ── Bundled Web SDK (~6KB)
└── test/ ── 36 tests
| Variable | Default | Description |
|---|---|---|
VAULT_MASTER_KEY | auto-generated | Encryption key (scrypt → 32 bytes) |
VAULT_CDP_URL | http://localhost:9222 | Chrome DevTools endpoint |
~/.vault-mcp/
├── credentials.json ── AES-256-GCM encrypted (unique IV per entry)
├── audit.jsonl ── Append-only, SHA-256 hash chain
└── .master-key ── Master key (mode 0600, auto-generated)
Protects against Does NOT protect against
───────────────── ────────────────────────
✓ LLM context leakage ✗ Compromised host (root access)
✓ Plaintext credential storage ✗ Malicious MCP client
✓ Audit log tampering ✗ Browser-level memory attacks
✓ Accidental exposure in logs ✗ Network MITM to target sites
See SECURITY.md for full threat model.
npm test # 36 tests
npm run test:watch
MIT
FAQs
MCP server for credential isolation in LLM agents — bots use passwords without seeing them
We found that chillai-vault-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.
Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.