vault_loginLog into a website using stored credentials. The bot never sees the password — Vault fills the login form via Chrome DevTools Protocol. Supports TOTP
vault_api_requestMake an API request with stored credentials. The API key is injected automatically — the bot never sees it. Supports header, query param, and basic au
vault_listList all available credentials in the vault. Returns only site IDs and types — no secrets.
vault_statusCheck the status of a specific credential: active/inactive, last used, audit count.
vault_addSecurely add a new credential to the vault. Opens a browser form where the user enters their password directly — the password NEVER passes through the
vault_removeRemove a credential from the vault permanently.
vault_updateUpdate an existing credential. Opens a browser form to enter new password/API key — the secret NEVER passes through the AI agent.
vault_checkVerify a credential is valid and ready to use. Checks existence, active status, required fields, and expiration.
vault_importImport API keys from a .env file. Each key is stored as an encrypted api_key credential. The .env values pass through memory only — never returned to
vault_templatesList available credential templates for popular services. Templates auto-fill login URLs and CSS selectors.
We re-grade npm:chillai-vault-mcp on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.
Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:
https://wmcp.sh/mcp/trust
readOnly vs observed behavior) layer on via the wmcp.sh proxy.