Login Vault

com.botrecipePublished by botrecipe.comv1.0.0Updated Oct 26, 2026

Scoped login vault: your bot signs in to sites without ever seeing the password.

The publisher's own server: Bot Recipes

VerifiedStreamable HTTPWeb executableBrowser AutomationDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote login vault that lets an assistant sign in to websites and make scoped requests without ever seeing the stored password or TOTP secret.

What you can do
  • Store, list and delete saved logins, each sealed with AES-256-GCM and limited by allowed hosts, methods, daily session cap and TTL
  • Create and revoke per-bot keys that only reach the logins you name
  • Open a session by filling username, password and TOTP into a form, returning an opaque session id
  • Make single HTTPS requests inside an open session, with secrets redacted from replies
  • End sessions and wipe their cookies
  • Review an audit log and a weekly plain-English report of sign-ins, sessions and blocked attempts, and check usage against the free tier
When to use it
Useful when an assistant or bot must log in to sites on your behalf but should never handle the raw credentials, and you want per-bot scoping, session caps and an audit trail. Suited to owners who can run the save step from their own machine.
Requirements
A remote MCP endpoint at vault.cloudforbots.com over streamable HTTP; no packages or environment variables declared. An owner Pro key is needed for owner-only tools such as saving logins, deleting logins, creating and revoking bot keys, and reading the audit log; bot keys (vk_...) are needed for session tools. The free tier allows 500 calls per day.
Before you install
The vault holds real site passwords and TOTP secrets, so the owner key is highly sensitive and should be kept out of bots; save logins from your own machine, not inside the bot. Bot keys are shown once and grant sign-in on the logins you name, so scope them narrowly and revoke them when done. Sessions make real authenticated requests to third-party sites, which can change data there. Paid upgrade is offered at $9/month.

Installation

In SourceWeft

  1. Open Login Vault in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.botrecipe%2Fvault/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "login-vault": {
      "type": "http",
      "url": "https://vault.cloudforbots.com/mcp"
    }
  }
}

Tools

11

save_login

Owner only (your Pro key, never a bot key). Store one login sealed with AES-256-GCM, with a scope: allowed hosts, allowed methods, a daily session cap and session TTL. Run it from your own machine, not inside the bot. The password and TOTP secret are never returned by any tool. Free watch-only stores nothing and logs would_use_vault.

Parametersnamerequiredscopedomainrequiredpasswordrequiredusernamerequiredtotp_secret

list_logins

List saved logins (name, domain, scope, sessions today; never secrets). With your owner key it also lists bot keys. A bot key only sees the logins it was granted.

Takes no parameters.

delete_login

Owner only. Delete a saved login, end its open sessions and remove it from every bot key.

Parametersnamerequired

create_bot_key

Owner only. Make a per-bot key (vk_...) that can only open sessions on the logins you name. Shown once; we store only its hash. Revoke any time with revoke_bot_key.

Parameterslabelrequiredloginsrequired

revoke_bot_key

Owner only. Revoke a bot key right away and end every session it opened.

Parametersbot_idrequired

open_session

Sign in with a saved login without seeing it. The server fills {{username}}, {{password}} and {{totp}} into your form, posts it to url (https, inside the login's allowed hosts), keeps the cookies encrypted, and returns an opaque session id. Checked against the login's scope and daily cap; logged to the audit log. If the site shows a CAPTCHA or new-device check, the reply suggests next_step request_human (Human Handoff relay). Free watch-only logs would_use_vault and signs in nowhere.

Parametersasurlrequiredformnamerequiredmethodprefetch

session_fetch

Make one request inside an open session. url must be https inside the login's allowed hosts and the method must be in its allowed methods. The password, TOTP secret and codes are redacted from the reply; cookies never leave the vault.

Parametersurlrequiredbodymethodheaderssessionrequired

end_session

End a session now and wipe its cookies.

Parameterssessionrequired

audit_log

Owner only. The last uses of your vault: who (bot label), which login, which domain, what happened. Never contains secrets.

Parameterslimit

weekly_report

Plain-English summary of the last 7 days: where your bots needed to sign in (by domain), sessions opened, blocked attempts, by bot. Read-only. Needs a key.

Takes no parameters.

usage_and_upgrade

Show today's usage for your key or IP and the $9/month upgrade link. Free tier: 500 calls/day. Not metered.

Takes no parameters.

Version history

1
  1. v1.0.0LatestOct 17, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Botrecipe integrations

Bot Recipes

com.botrecipeOfficial publisher

A remote MCP server for searching free bot recipes and browsing a directory of MCP servers and bots.

Streamable HTTPWeb executable
Productivity & Workflow3 toolsOct 24, 2026

Compute Connector

com.botrecipe

Compute Connector's hosted MCP server, published by botrecipe.com; no sign-in required; Streamable HTTP; 8 tools.

Streamable HTTPWeb executable
8 toolsOct 25, 2026

Cloud for Bots

com.botrecipe

Cloud for Bots gives an AI agent a hosted toolkit: loop detection, run checkpoints, budget caps, approval rules, wake-ups, a bot recipe library, secrets…

Streamable HTTPWeb executableAuth
Cloud & Infrastructure48 toolsOct 27, 2026

Sandbox Timer

com.botrecipe

Tracks an agent's cloud sandbox sessions, flags idle or over-age ones, estimates idle cost, and returns kill calls.

Streamable HTTPWeb executable
Cloud & Infrastructure5 toolsOct 24, 2026

Agent Cost Log

com.botrecipe

Remote MCP server that logs AI agent model and tool call costs and reports spend per run, tool, model and day.

Streamable HTTPWeb executable
Data & Analytics4 toolsOct 24, 2026