Hive Vault

io.github.srotzinPublished by GitHub account srotzinv1.0.0Updated Oct 24, 2026

A2A ZK wallet recovery — guardian swarm, no seed phrase, HiveLaw enforcement

VerifiedStreamable HTTPWeb executableFinanceSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server exposing read-only HiveVault service data: balance view, statistics, identity document and quantum public key.

What you can do
Read the HiveVault Base USDC display balance, which may be marked obfuscated when unauthenticated and is not a confirmed treasury balance. Read live HiveVault service statistics. Read the service identity document. Read the published quantum-signature public key and algorithm metadata. The README also describes an encrypted item store and health endpoints outside the MCP tool list.
When to use it
Useful when you want an assistant to look up public HiveVault service information such as statistics, identity details or the published quantum public key without setting up a local process.
Requirements
A remote streamable HTTP endpoint; no package installation or declared authentication. The README lists optional server-side settings such as VAULT_BACKEND_URL and BASE_RPC_URL, and production-only settings INTERNAL_KEY and BOGO_DB_PATH, but these apply to running the service yourself, not to connecting as a client.
Before you install
The balance tool returns a display value that can be marked obfuscated when unauthenticated; do not treat it as a confirmed treasury balance. The README mentions an encrypted store gated by x402 payment verification and an INTERNAL_KEY sent to the backend as x-vault-key, so review what data and credentials are involved before using those paths.

Installation

In SourceWeft

  1. Open Hive Vault in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.srotzin%2Fhive-mcp-vault/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hive-vault": {
      "type": "http",
      "url": "https://hive-mcp-vault.onrender.com/mcp"
    }
  }
}

README

hive-mcp-vault

[srotzin/hive-mcp-vault MCP server]

MCP access to confirmed HiveVault FENR reads and an AES-256-GCM encrypted item store.

Live contract

The server exposes four read-only MCP tools backed by the live HiveVault service:

ToolLive backend route
vault.balanceGET /vault/balance
vault.statsGET /vault/stats
vault.identityGET /vault/identity
vault.quantum_pubkeyGET /vault/quantum/pubkey

vault.balance returns the backend response exactly as received. An unauthenticated response can be marked obfuscated: true; clients must not treat that value as a confirmed treasury balance.

The server also exposes an encrypted item store:

MethodPathDescription
POST/v1/vault/storeStore an AES-256-GCM encrypted item after the x402 gate
GET/v1/vault/store/:item_refConfirm a stored item exists without returning plaintext

Unknown paths return HTTP 404. Upstream failures return explicit MCP errors. The service does not return fabricated success payloads.

Discovery and health

MethodPathDescription
GET/healthReadiness. This process plus current upstream reachability. Returns 503 and degraded when the upstream is unreachable
GET/livezLiveness only. This process, no upstream claim. This is the path platform health checks should use
POST/mcpMCP JSON-RPC 2.0, protocol 2024-11-05
GET/.well-known/mcp.jsonMCP discovery manifest
GET/.well-known/agent-card.jsonA2A agent card
GET/.well-known/agent.jsonAgent card
GET/.well-known/oac.jsonOpen Agent Card JSON-LD
GET/llms.txtPlain-text integration guide

Persistence

Set BOGO_DB_PATH to a path on durable storage in production. The default path, /tmp/bogo_vault.db, is suitable only for local development and tests. The server refuses to start in production unless an explicit database path is configured.

Environment variables

VariableRequiredPurpose
PORTNo, default 3000HTTP port
VAULT_BACKEND_URLNo, default https://hive-vault.onrender.comLive HiveVault backend
INTERNAL_KEYYes in productionDerives the local encryption key and is sent to the backend as x-vault-key
BOGO_DB_PATHYes in productionSQLite database path on durable storage. Local development defaults to /tmp/bogo_vault.db
BASE_RPC_URLNo, default https://mainnet.base.orgBase RPC endpoint used for x402 payment verification

The server refuses to start with NODE_ENV=production if INTERNAL_KEY or BOGO_DB_PATH is missing.

Testing

bash
npm installnpm test

Tests cover health reporting, unknown-route handling, MCP tool discovery, upstream failure behavior, encrypted storage, and plaintext absence from the SQLite file.

Brand

Hive Civilization. Brand gold #C08D23. Steve Rotzin.

Directory

Source: README.md at commit 65fd1b1

Tools

4

vault.balance

Read the HiveVault Base USDC display balance view. The unauthenticated backend marks this value as obfuscated.

Takes no parameters.

vault.stats

Read live HiveVault service statistics.

Takes no parameters.

vault.identity

Read the live HiveVault service identity document.

Takes no parameters.

vault.quantum_pubkey

Read the quantum-signature public key and algorithm metadata published by HiveVault.

Takes no parameters.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts