Search / com.botrecipe/vault
protogridR0· no sign-inScoped login vault: your bot signs in to sites without ever seeing the password.
v1.0.0 · active · website · descriptor JSON · versions
{
"mcpServers": {
"vault": {
"type": "http",
"url": "https://vault.cloudforbots.com/mcp"
}
}
}claude mcp add --transport http vault https://vault.cloudforbots.com/mcp[mcp_servers.vault]
url = "https://vault.cloudforbots.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vault": {
"type": "remote",
"url": "https://vault.cloudforbots.com/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"vault": {
"type": "http",
"url": "https://vault.cloudforbots.com/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=vault&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdmF1bHQuY2xvdWRmb3Jib3RzLmNvbS9tY3AifQ%3D%3D"
}{
"servers": {
"vault": {
"type": "http",
"url": "https://vault.cloudforbots.com/mcp"
}
}
}{
"mcpServers": {
"vault": {
"httpUrl": "https://vault.cloudforbots.com/mcp"
}
}
}extensions:
"vault":
enabled: true
name: "vault"
type: streamable_http
uri: "https://vault.cloudforbots.com/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky onestools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: delete_login (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); save_login (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); open_session (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …tools.token_costabout 1,212 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes, stability.rug_pulltool history recorded for 3 of the 7 days neededdeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+dns-namespace +website +reachable +uptime-100% +updated-4d-ago -no-repository
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://vault.cloudforbots.com/mcp streamable-http | none | yes | 100% | 236 ms | 2025-11-25 | 2026-10-20 |
audit_log | Owner only. The last uses of your vault: who (bot label), which login, which domain, what happened. Never contains secrets. |
create_bot_key | Owner only. Make a per-bot key (vk_...) that can only open sessions on the logins you name. Shown once; we store only its hash. Revoke any time with revoke_bot_key. |
delete_login | Owner only. Delete a saved login, end its open sessions and remove it from every bot key. |
end_session | End a session now and wipe its cookies. |
list_logins | List saved logins (name, domain, scope, sessions today; never secrets). With your owner key it also lists bot keys. A bot key only sees the logins it was granted. |
open_session | Sign in with a saved login without seeing it. The server fills {{username}}, {{password}} and {{totp}} into your form, posts it to url (https, inside the login's allowed hosts), keeps the cookies encrypted, and returns an opaque session id. Checked against the login's scope and daily cap; logged to the audit log. If the site shows a CAPTCHA or new-device check, the reply suggests next_step request_human (Human Handoff relay). Free watch-only logs would_use_vault and signs in nowhere. |
revoke_bot_key | Owner only. Revoke a bot key right away and end every session it opened. |
save_login | Owner only (your Pro key, never a bot key). Store one login sealed with AES-256-GCM, with a scope: allowed hosts, allowed methods, a daily session cap and session TTL. Run it from your own machine, not inside the bot. The password and TOTP secret are never returned by any tool. Free watch-only stores nothing and logs would_use_vault. |
session_fetch | Make one request inside an open session. url must be https inside the login's allowed hosts and the method must be in its allowed methods. The password, TOTP secret and codes are redacted from the reply; cookies never leave the vault. |
usage_and_upgrade | Show today's usage for your key or IP and the $9/month upgrade link. Free tier: 500 calls/day. Not metered. |
weekly_report | Plain-English summary of the last 7 days: where your bots needed to sign in (by domain), sessions opened, blocked attempts, by bot. Read-only. Needs a key. |
Schemas: list_tools.
And 8 more from this publisher.
{
"name": "com.botrecipe/vault",
"title": "Login Vault",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://vault.cloudforbots.com/mcp",
"type": "streamable-http"
}
],
"version": "1.0.0",
"websiteUrl": "https://vault.cloudforbots.com",
"description": "Scoped login vault: your bot signs in to sites without ever seeing the password."
}