Agentvault

io.github.bch1212Published by GitHub account bch1212v0.1.0Updated Oct 24, 2026

Credential vault for AI agents — Fernet-encrypted keys, per-agent budgets, audit logs.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that lets an assistant fetch encrypted API keys from an AgentVault deployment, with per-agent permissions, budgets and audit logging.

What you can do
List the credentials an agent is allowed to see and fetch a decrypted value with a time-limited TTL, recording the spend cost of each fetch against the agent's budget. Check vault status and set daily or monthly spending caps for an agent. Review the access audit log of successful and denied credential reads. Credentials are stored with column-level Fernet encryption and agent keys are hashed at rest.
When to use it
Use it when an autonomous agent needs API keys for services such as Stripe, OpenAI or SendGrid and you want per-agent scoping, spending caps and an access trail instead of hardcoding keys in prompts or environment variables. It suits teams already running or self-hosting an AgentVault deployment.
Requirements
Runs as a local stdio process from the npm package agentvault-mcp. Requires an AgentVault deployment reachable over the network, set in AGENTVAULT_API_URL, and an avk_ agent API key in AGENTVAULT_AGENT_KEY. The hosted service is paid beyond the free tier; self-hosting needs a database and an encryption key.
Before you install
The server hands out decrypted credential values to the assistant, so anything it reads can end up in the model's context or logs. AGENTVAULT_AGENT_KEY is a secret that grants access to the vault. Fetches can record spend against budgets, and set_budget changes limits. The hosted deployment is a third-party service that stores your credentials and access logs.

Installation

In SourceWeft

  1. Open Agentvault in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

AgentVault

AI-native credential management for autonomous agents. Store API keys with column-level Fernet encryption, issue unique avk_ keys to registered agent identities, proxy decrypted values with TTL, enforce per-agent spending budgets, log every access, and expose everything as an MCP server.

Why

Autonomous agents need API keys to do anything useful — Stripe, OpenAI, SendGrid, your own internal services. Three bad options today:

  1. Hardcode in the agent prompt or config. Leaks in logs, can't rotate, no audit trail.
  2. Pass via env vars at spawn. No per-agent isolation, no budget controls, no revocation without redeploy.
  3. Roll your own vault. Real work — encryption at rest and in transit, audit logs, key rotation, budget tracking.

AgentVault is option 3 as a service. One avk_ key per agent. Permission patterns (["stripe_*", "openai_*"]). Daily/monthly spending caps. Full access log. MCP-native so agents can vault.get_credential("stripe_key") and get a TTL-bound decrypted value back.

Quickstart

Direct HTTP

python
import httpx
resp = httpx.post(    "https://agentvault-api-production.up.railway.app/api/v1/vault/get/stripe_key",    headers={"X-Agent-Key": "avk_..."},    params={"cost": 0.05},)stripe_key = resp.json()["value"]

MCP (Claude Desktop / Cursor / Cline)

json
{  "mcpServers": {    "agentvault": {      "command": "python",      "args": ["-m", "mcp_server"],      "env": {        "AGENTVAULT_API_URL": "https://agentvault-api-production.up.railway.app",        "AGENTVAULT_AGENT_KEY": "avk_..."      }    }  }}

Then in Claude: vault.get_credential("stripe_key") returns the decrypted value.

How it works

  • Column-level Fernet encryption — credentials are encrypted with VAULT_ENCRYPTION_KEY before they hit the database. Stronger than at-rest disk encryption alone.
  • avk_ agent keys — SHA-256 hashed at rest, never stored plaintext. Recognizable prefix like sk_live_ / whsec_.
  • Permission patterns — ["stripe_*", "openai_*"] scopes an agent without a full policy engine. fnmatch-based.
  • Budget enforcement — daily and monthly caps per agent. /vault/get?cost=0.05 records the spend; 429 once the cap is hit.
  • Audit log — every access (success or denied) goes into credential_access_logs with IP, user-agent, error reason.
  • MCP server — mcp_server/ exposes list_credentials, get_credential, vault_status, set_budget, view_audit_log as stdio MCP tools.

Pricing

Tier$/moAgentsCredentialsAuditRotationBudgetsTeam
Free$0310––––
Pro$4925100✓✓––
Business$149∞∞✓✓✓✓
Enterprise$499∞∞✓✓✓✓ + SSO + compliance

Self-host

bash
git clone https://github.com/bch1212/agentvaultcd agentvaultpip install -r requirements.txtcp .env.example .env  # then fill in VAULT_ENCRYPTION_KEY and DATABASE_URLpython -m api.main

Run tests:

bash
python -m pytest -v   # 34 tests

Deploy to Railway:

bash
bash deploy.sh

Architecture

api/├── main.py                 # FastAPI + lifespan├── database.py             # Async SQLAlchemy (auto-rewrites postgresql:// → postgresql+asyncpg://)├── services/│   ├── encryption.py       # Fernet encrypt/decrypt│   ├── auth.py             # avk_ key gen + SHA-256 hashing│   ├── budget.py           # Per-agent spend tracking│   ├── audit.py            # Access log│   └── alerts.py           # SendGrid alerts├── middleware/             # X-Agent-Key + Bearer auth└── routers/                # users, agents, credentials, vault, audit, budgets, billingmcp_server/                 # FastMCP stdio servertests/                      # 34 tests, SQLite in-memory

License

MIT.

Source: README.md at commit 044b1dc

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts