Envault MCP Server

Secure secret management with a Human-In-The-Loop (HITL) interceptor for agent mutations.

Remote serverstreamable-httpGo

What is the Envault MCP Server?

Secure secret management with a Human-In-The-Loop (HITL) interceptor for agent mutations.

What it actually does

Envault natively supports the Model Context Protocol (MCP), so AI coding assistants like Claude Desktop, Cursor, and RooCode/Cline can pull and push your secure environments effortlessly.

  • Bank-Grade Security — AES-256-GCM encryption with master/data key hierarchy and automatic key rotation
  • Project Workspaces — Organize secrets into distinct projects for better management
  • Semantic Routing — Clean, GitHub-style URLs (/[username]/[project-slug]) for easy sharing and navigation
  • Team Collaboration — Secure project sharing with strict Role-Based Access Control:
  • Owner: Full administrative control (Rename, Delete, Manage Team)
  • Editor: Active contributor (Read/Write secrets, request to Share)

Configuration

  • Node.js 18+ installed - A Supabase project set up

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the Envault MCP Server

{
  "mcpServers": {
    "envault": {
      "command": "npx",
      "args": ["-y", "portless"],
      "env": {
        "ENVAULT_CLI_URL": "your-value",
        "ENVAULT_BASE_URL": "your-value",
        "NEXT_PUBLIC_SUPABASE_URL": "your-value",
        "NEXT_PUBLIC_SUPABASE_ANON_KEY": "your-value",
        "ENCRYPTION_KEY": "your-value",
        "SUPABASE_SERVICE_ROLE_KEY": "your-value",
        "UPSTASH_REDIS_REST_URL": "your-value",
        "UPSTASH_REDIS_REST_TOKEN": "your-value"
      }
    }
  }
}

Add to claude_desktop_config.json, then restart Claude Desktop.

Configuration

  • Node.js 18+ installed - A Supabase project set up
VariableDescriptionRequired
ENVAULT_CLI_URLEndpoint or connection string the server talks to.Yes
ENVAULT_BASE_URLEndpoint or connection string the server talks to.Yes
NEXT_PUBLIC_SUPABASE_URLEndpoint or connection string the server talks to.Yes
NEXT_PUBLIC_SUPABASE_ANON_KEYCredential the server authenticates with.Yes
ENCRYPTION_KEYCredential the server authenticates with.Yes
SUPABASE_SERVICE_ROLE_KEYCredential the server authenticates with.Yes
UPSTASH_REDIS_REST_URLEndpoint or connection string the server talks to.Yes
UPSTASH_REDIS_REST_TOKENCredential the server authenticates with.Yes

Example prompts to try

  • “Use Envault to Installation.”
  • “Use Envault to Prerequisites.”

Frequently asked questions

Secure secret management with a Human-In-The-Loop (HITL) interceptor for agent mutations. Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.