{"id":50879313,"url":"https://github.com/zavora-ai/mcp-credentials-vault","last_synced_at":"2026-06-15T12:04:33.186Z","repository":{"id":359766154,"uuid":"1247425510","full_name":"zavora-ai/mcp-credentials-vault","owner":"zavora-ai","description":"Scoped, auditable credential access for ADK-Rust Enterprise agents. Provides 8 MCP tools over 5 pluggable vault backends — never exposes raw secrets to LLM context.","archived":false,"fork":false,"pushed_at":"2026-05-23T11:11:37.000Z","size":97,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-23T12:09:43.414Z","etag":null,"topics":["adk-rust","adk-rust-enterprise","credentials","credentials-management","credentials-manager"],"latest_commit_sha":null,"homepage":"https://enterprise.adk-rust.com","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zavora-ai.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-23T09:49:54.000Z","updated_at":"2026-05-23T11:11:41.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/zavora-ai/mcp-credentials-vault","commit_stats":null,"previous_names":["zavora-ai/mcp-credentials-vault"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/zavora-ai/mcp-credentials-vault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavora-ai%2Fmcp-credentials-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavora-ai%2Fmcp-credentials-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavora-ai%2Fmcp-credentials-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavora-ai%2Fmcp-credentials-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zavora-ai","download_url":"https://codeload.github.com/zavora-ai/mcp-credentials-vault/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zavora-ai%2Fmcp-credentials-vault/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34361405,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adk-rust","adk-rust-enterprise","credentials","credentials-management","credentials-manager"],"created_at":"2026-06-15T12:04:32.426Z","updated_at":"2026-06-15T12:04:33.172Z","avatar_url":"https://github.com/zavora-ai.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Credentials Vault MCP Server\n\n[![Crates.io](https://img.shields.io/crates/v/mcp-credentials-vault.svg)](https://crates.io/crates/mcp-credentials-vault)\n[![Docs.rs](https://docs.rs/mcp-credentials-vault/badge.svg)](https://docs.rs/mcp-credentials-vault)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![ADK-Rust Enterprise](https://img.shields.io/badge/ADK--Rust-Enterprise-purple.svg)](https://enterprise.adk-rust.com)\n[![Registry Ready](https://img.shields.io/badge/ADK_Registry-Ready-green.svg)](https://enterprise.adk-rust.com)\n\nScoped, auditable credential access for [ADK-Rust Enterprise](https://enterprise.adk-rust.com) agents. Provides 8 MCP tools over 5 pluggable vault backends — **never exposes raw secrets to LLM context**.\n\n## Architecture\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/zavora-ai/mcp-credentials-vault/main/docs/architecture.svg\" alt=\"Credentials Vault MCP Architecture\" width=\"800\"/\u003e\n\u003c/p\u003e\n\n## Key Principles\n\n- **Zero secret exposure** — raw secrets never reach LLM context. Tools return handles and short-lived tokens only.\n- **Scoped access** — credentials declare which agents, skills, and MCP servers can use them.\n- **Full audit trail** — every access, denial, rotation, and revocation is logged.\n- **Pluggable backends** — use one or many vault backends simultaneously.\n- **Registry-ready** — ships with `mcp-server.toml` for automatic ADK-Rust Enterprise onboarding.\n\n## Tools\n\n| Tool | Purpose | Risk Class |\n|------|---------|------------|\n| `list_credentials` | List credential metadata (never raw values) | Read-only |\n| `get_credential_metadata` | Inspect owner, scope, expiry, rotation, risk | Read-only |\n| `request_runtime_secret` | Issue scoped runtime handle after policy checks | Identity/Security |\n| `request_workload_token` | Mint short-lived OIDC/workload identity token | Identity/Security |\n| `rotate_credential` | Rotate secret through approved workflow | Identity/Security |\n| `revoke_credential` | Disable compromised or expired credential | Identity/Security |\n| `audit_credential_access` | Retrieve access/denial/rotation audit events | Read-only |\n| `validate_secret_scope` | Check if an actor can use a credential | Read-only |\n\n## Backends\n\n| Backend | Feature Flag | Use Case |\n|---------|-------------|----------|\n| HashiCorp Vault | `hashicorp` | Self-hosted, KV v2, dynamic secrets |\n| AWS Secrets Manager | `aws` | AWS-native workloads |\n| GCP Secret Manager | `gcp` | GCP-native workloads |\n| Azure Key Vault | `azure` | Azure-native workloads |\n| ADK Vault | `adk-vault` | Platform-managed credentials (default) |\n| ADK Platform API | `adk-platform` | ADK-Rust Enterprise centralized management |\n\n## Installation\n\n### Build from source\n\n```bash\ngit clone https://github.com/zavora-ai/mcp-credentials-vault\ncd mcp-credentials-vault\ncargo build --release --features all-backends\n```\n\nThe binary is at `target/release/mcp-credentials-vault`.\n\n### Claude Desktop\n\nAdd to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"args\": [],\n      \"env\": {\n        \"RUST_LOG\": \"info\"\n      }\n    }\n  }\n}\n```\n\n### Kiro\n\nAdd to your project's `.kiro/settings/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"args\": [],\n      \"env\": {\n        \"RUST_LOG\": \"info\"\n      }\n    }\n  }\n}\n```\n\n### Codex (OpenAI)\n\nAdd to `~/.codex/config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\"\n    }\n  }\n}\n```\n\n### Antigravity\n\nAdd to your Antigravity workspace MCP configuration:\n\n```json\n{\n  \"servers\": [\n    {\n      \"name\": \"credentials-vault\",\n      \"transport\": \"stdio\",\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"env\": {\n        \"RUST_LOG\": \"info\"\n      }\n    }\n  ]\n}\n```\n\n### Open Code\n\nAdd to `~/.config/opencode/config.json`:\n\n```json\n{\n  \"mcp\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"args\": []\n    }\n  }\n}\n```\n\n### Cursor\n\nAdd to `.cursor/mcp.json` in your project root:\n\n```json\n{\n  \"mcpServers\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"args\": []\n    }\n  }\n}\n```\n\n### Windsurf\n\nAdd to `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"credentials-vault\": {\n      \"command\": \"/path/to/mcp-credentials-vault\",\n      \"args\": []\n    }\n  }\n}\n```\n\n### Any MCP Client (Streamable HTTP)\n\nFor clients that support HTTP transport, run the server in HTTP mode:\n\n```bash\nmcp-credentials-vault --transport http --port 8080\n```\n\nThen connect your client to `http://localhost:8080/mcp`.\n\n### Docker\n\n```bash\ndocker run -p 8080:8080 \\\n  -e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \\\n  -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY \\\n  -e GOOGLE_APPLICATION_CREDENTIALS=/creds/gcp.json \\\n  -v ~/.config/gcloud/application_default_credentials.json:/creds/gcp.json \\\n  ghcr.io/zavora-ai/mcp-credentials-vault:latest\n```\n\n## Quick Start\n\n### Installation\n\n```toml\n[dependencies]\nmcp-credentials-vault = { version = \"1.0\", features = [\"all-backends\"] }\n```\n\nOr select specific backends:\n\n```toml\n[dependencies]\nmcp-credentials-vault = { version = \"1.0\", features = [\"aws\", \"gcp\"] }\n```\n\n### Running as MCP Server\n\n```rust\nuse mcp_credentials_vault::{adk_vault::AdkVaultBackend, server::CredentialsVaultServer};\nuse rmcp::{ServiceExt, transport::stdio};\n\n#[tokio::main]\nasync fn main() -\u003e anyhow::Result\u003c()\u003e {\n    let backend = AdkVaultBackend::new(Some(\"./credentials.json\".into()));\n    let server = CredentialsVaultServer::new(vec![Box::new(backend)]);\n    let service = server.serve(stdio()).await?;\n    service.waiting().await?;\n    Ok(())\n}\n```\n\n### Multi-backend Configuration\n\n```rust\nuse mcp_credentials_vault::{\n    adk_vault::AdkVaultBackend,\n    aws::AwsBackend,\n    gcp::GcpBackend,\n    server::CredentialsVaultServer,\n};\n\nlet server = CredentialsVaultServer::new(vec![\n    Box::new(AdkVaultBackend::new(None)),\n    Box::new(AwsBackend::new(Some(\"us-east-1\".into())).await),\n    Box::new(GcpBackend::new(\"my-project\".into()).await?),\n]);\n```\n\n## Configuration\n\n### Environment Variables\n\n| Variable | Backend | Purpose |\n|----------|---------|---------|\n| `ADK_PLATFORM_URL` | ADK Platform | Platform base URL |\n| `ADK_PLATFORM_API_KEY` | ADK Platform | API key (`ep_live_xxxx`) |\n| `ADK_WORKSPACE_ID` | ADK Platform | Workspace UUID |\n| `ADK_VAULT_PATH` | ADK Vault | JSON persistence file path |\n| `VAULT_ADDR` | HashiCorp | Vault server URL |\n| `VAULT_TOKEN` | HashiCorp | Authentication token |\n| `AWS_REGION` | AWS | AWS region |\n| `AWS_ACCESS_KEY_ID` | AWS | AWS credentials (or use IAM role) |\n| `GCP_PROJECT_ID` | GCP | GCP project ID |\n| `AZURE_VAULT_URL` | Azure | Key Vault URL |\n| `AZURE_ACCESS_TOKEN` | Azure | Azure AD token |\n\n### MCP Server Manifest\n\nThe server ships with `mcp-server.toml` for ADK-Rust Enterprise registry onboarding:\n\n```toml\nserver_id = \"mcp_credentials_vault\"\ndisplay_name = \"Credentials Vault MCP\"\nversion = \"1.0.0\"\ndomain = \"platform\"\nrisk_level = \"critical\"\nwrites_allowed = \"gated\"\ntransports = [\"stdio\", \"streamable_http\"]\ngovernance_gates = [\"policy_evaluation_required\", \"audit_all_access\"]\n```\n\n## Security Model\n\n```\nAgent requests credential → Scope validation → Policy check → Handle issued\n                                                                    │\n                                                                    ▼\n                                                    Runtime worker resolves\n                                                    handle to actual secret\n                                                    (outside LLM context)\n```\n\n1. **Agents never see raw secrets** — only handles with expiry and scope\n2. **Scope enforcement** — credentials declare allowed actors\n3. **Audit everything** — access, denials, rotations, revocations\n4. **Short-lived tokens** — workload tokens expire (default 5 min for runtime, 1 hour for workload)\n5. **Governance gates** — `rotate` and `revoke` require approval in production\n\n## Testing\n\n```bash\n# Build with all backends\ncargo build --features all-backends\n\n# Run tests (ADK Vault — no external deps)\ncargo test\n\n# Run with real backends (requires credentials)\ncargo test --features all-backends\n\n# Run the integration test binary\ncargo run --features all-backends\n```\n\n## Documentation\n\n| Document | Description |\n|----------|-------------|\n| [API Reference](docs/api-reference.md) | All 8 tools with parameters, returns, and examples |\n| [Backends](docs/backends.md) | Configuration for each vault backend |\n| [Security Model](docs/security-model.md) | Zero-exposure architecture and threat model |\n| [CHANGELOG.md](CHANGELOG.md) | Version history |\n| [mcp-server.toml](mcp-server.toml) | ADK-Rust Enterprise registry manifest |\n| [CONTRIBUTING.md](CONTRIBUTING.md) | Development guidelines |\n| [SECURITY.md](SECURITY.md) | Vulnerability reporting |\n| [Rust Docs](https://docs.rs/mcp-credentials-vault) | Generated API documentation |\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.\n\n## Contributors\n\n\u003c!-- ALL-CONTRIBUTORS-LIST:START --\u003e\n| [\u003cimg src=\"https://github.com/jkmaina.png\" width=\"80px;\" alt=\"\"/\u003e\u003cbr /\u003e\u003csub\u003e\u003cb\u003eJames Karanja Maina\u003c/b\u003e\u003c/sub\u003e](https://github.com/jkmaina) |\n|:---:|\n\u003c!-- ALL-CONTRIBUTORS-LIST:END --\u003e\n\n## License\n\nApache-2.0 — see [LICENSE](LICENSE) for details.\n\n---\n\nPart of the [ADK-Rust Enterprise](https://enterprise.adk-rust.com) MCP server ecosystem.\n\nBuilt with ❤️ by [Zavora AI](https://zavora.ai)\n\n## Registry Compliance\n\nThis server implements the [ADK MCP SDK](https://crates.io/crates/adk-mcp-sdk) contract:\n\n- **HealthCheck** — async health probe for registry monitoring\n- **mcp-server.toml** — manifest declaring tools, risk classes, and credentials\n- **Structured tracing** — `RUST_LOG` env-filter for observability\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzavora-ai%2Fmcp-credentials-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzavora-ai%2Fmcp-credentials-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzavora-ai%2Fmcp-credentials-vault/lists"}