MCP server for credential isolation — bots use passwords and API keys without seeing them

How do I install Vault MCP?

Clone Vault MCP from https://github.com/Chill-AI-Space/vault-mcp and configure it as an MCP server in your client (Claude Desktop, Cursor, or VS Code).

What category does Vault MCP belong to?

Vault MCP is listed under Other MCP servers on MCPFind.

Vault MCP — MCP Server for Other

zerocreds-mcp

MCP server for ZeroCreds — collect credentials from users without exposing them to the LLM.

How it works

Claude                    ZeroCreds Server            User
  │                            │                        │
  ├─zerocreds_create_session──►│                        │
  │◄─{ token, url }────────────┤                        │
  │                            │                        │
  │  "Please fill: <url>"──────────────────────────────►│
  │                            │◄──── form submit ───────┤
  │                            │  (credentials saved)    │
  │                            │                        │
  ├─zerocreds_check_status─────►│                        │
  │◄─{ status: "done" }────────┤                        │
  │                            │                        │
  │  (proceeds — never saw the credentials)

Setup

npm install -g zerocreds-mcp

Add to ~/.claude/mcp.json (Claude Code) or Claude Desktop config:

{
  "mcpServers": {
    "zerocreds": {
      "command": "zerocreds-mcp",
      "env": {
        "ZEROCREDS_URL": "https://zerocreds.ru",
        "ZEROCREDS_TOKEN": "your-admin-or-integrator-token",
        "ZEROCREDS_DEFAULT_DESTINATION": "local-dev",
        "ZEROCREDS_TG_BOT_TOKEN": "optional — sends link via Telegram",
        "ZEROCREDS_TG_CHAT_ID": "optional"
      }
    }
  }
}

Environment variables

Variable	Required	Description
`ZEROCREDS_URL`	no	Server URL (default: `https://zerocreds.ru`)
`ZEROCREDS_TOKEN`	yes	Admin or integrator token
`ZEROCREDS_DEFAULT_DESTINATION`	no	Default destination name (default: `local-dev`)
`ZEROCREDS_TG_BOT_TOKEN`	no	Telegram bot token — auto-sends the link
`ZEROCREDS_TG_CHAT_ID`	no	Telegram chat ID

Tools

`zerocreds_create_session`

Creates a one-time form session. Returns { token, url, expires_at }.

Claude shows url to the user, then polls zerocreds_check_status every 5–10 seconds.

Parameters:

title (required) — form heading
fields (required) — array of { name, label, type?, placeholder?, required?, level? }
description — optional subtext
destination — named destination from server config; overrides env default
ttl_minutes — link expiry (default: 30)

Field types: text, password, email, tel, number, textarea, url

Field levels (optional, shown to user as privacy indicator): secret · pii · attribute · credential

`zerocreds_check_status`

Polls session status. Returns { status: "pending" | "done" | "expired" }.

Example agent flow

User: "Log me into GitHub"

Claude: [zerocreds_create_session]
  title: "Connect GitHub"
  fields: [
    { name: "token", label: "Personal Access Token", type: "password" }
  ]
→ { token: "abc123", url: "https://zerocreds.ru/f/abc123" }

Claude: "Please fill in your token here: https://zerocreds.ru/f/abc123"

[polls zerocreds_check_status every 5s]
→ { status: "done" }

Claude: "GitHub connected! Proceeding..."
[reads token from secret store via configured destination]

Self-hosting

See zerocreds-server to run your own instance.

License

MIT

Set up in your AI client

AI clientOperating system

Merge this template into ~/Library/Application Support/Claude/claude_desktop_config.json. Keep existing servers. Add any arguments, credentials, and permissions required by the maintainer; this template has not been install-tested.

json

{
  "mcpServers": {
    "io-github-chill-ai-space-vault": {
      "command": "npx",
      "args": [
        "-y",
        "chillai-vault-mcp"
      ]
    }
  }
}

Restart Claude Desktop completely for changes to take effect. Confirm the server appears connected in the client’s tool list, then try a read-only example from its documentation.

Claude Desktop setup reference

Compatible MCP Clients

Vault MCP works with any MCP-compatible client. Copy the config snippet from the Configuration section above and add it to the file shown for your client, then restart the application.

Claude Desktop~/Library/Application Support/Claude/claude_desktop_config.jsonRestart Claude Desktop completely for changes to take effect.

Cursor~/.cursor/mcp.jsonRestart Cursor for changes to take effect.

VS Code.vscode/mcp.jsonReload VS Code window for changes to take effect.

Windsurf~/.codeium/windsurf/mcp_config.jsonRestart Windsurf for changes to take effect.

Claude Code.mcp.jsonSave at the project root, then start Claude Code in that project and review the MCP server approval prompt. Keep real credentials out of shared files.

Vault MCP