Navigation
Vault access. Public access is not open. This product is separate from initial Identity and Apparatus access.
Screenshots use fictional demonstration accounts. Your data and available actions may differ. Reviewed October 16, 2026.
Reference
Vault MCP tool reference
Connect to https://vault.ghoststack.app/api/mcp through an authorized remote HTTP MCP client. Identity provides authorization. Tools operate within the authenticated workspace and the applicable role, grant and agent scope.
| Tool | Purpose |
|---|---|
vault.whoami | Inspect identity, workspace and scope context |
vault.list_credentials | Browse permitted metadata by known key or prefix |
vault.search_credentials | Search permitted names, descriptions, keys and tags |
vault.list_folders | Find available storage locations |
vault.lease_credential | Issue an attributed time-limited read handle |
vault.read_credential | Redeem that handle once |
vault.revoke_lease | End an outstanding lease |
vault.list_my_leases | Inspect the caller’s leases |
vault.store_credential | Store a credential within authorized scope |
vault.rotate_credential | Replace a stored value with justification |
vault.archive_credential | Remove a record from active use |
vault.restore_credential | Restore an eligible archived record |
The server’s tool schema is the exact argument contract. Lease requests use credentialKey, agentRunId, justification and optional ttlSeconds. Reads use leaseHandle and optional responseFormat (plaintext or reference). Default reads return plaintext; typed records return a JSON envelope inside it.
Read/discovery/lease tools require vault:read; storage, rotation and archive/restore require vault:write. Higher scopes satisfy lower tiers, but do not bypass domain permissions. See scopes.
The server is not the historical local @ghoststack/vault-mcp stdio package. Use the connection guide and reference handling before retrieving real values.
Screen reference
