Vault Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Vault Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for ZeroCreds — collect credentials from users without exposing them to the LLM.
Claude ZeroCreds Server User
│ │ │
├─zerocreds_create_session──►│ │
│◄─{ token, url }────────────┤ │
│ │ │
│ "Please fill: <url>"──────────────────────────────►│
│ │◄──── form submit ───────┤
│ │ (credentials saved) │
│ │ │
├─zerocreds_check_status─────►│ │
│◄─{ status: "done" }────────┤ │
│ │ │
│ (proceeds — never saw the credentials)npm install -g zerocreds-mcpAdd to ~/.claude/mcp.json (Claude Code) or Claude Desktop config:
{
"mcpServers": {
"zerocreds": {
"command": "zerocreds-mcp",
"env": {
"ZEROCREDS_URL": "https://zerocreds.ru",
"ZEROCREDS_TOKEN": "your-admin-or-integrator-token",
"ZEROCREDS_DEFAULT_DESTINATION": "local-dev",
"ZEROCREDS_TG_BOT_TOKEN": "optional — sends link via Telegram",
"ZEROCREDS_TG_CHAT_ID": "optional"
}
}
}
}| Variable | Required | Description |
|---|---|---|
ZEROCREDS_URL | no | Server URL (default: https://zerocreds.ru) |
ZEROCREDS_TOKEN | yes | Admin or integrator token |
ZEROCREDS_DEFAULT_DESTINATION | no | Default destination name (default: local-dev) |
ZEROCREDS_TG_BOT_TOKEN | no | Telegram bot token — auto-sends the link |
ZEROCREDS_TG_CHAT_ID | no | Telegram chat ID |
zerocreds_ensure_serverEnsures the ZeroCreds MCP server is running. If it is not already running, this tool starts it in the background and waits for it to become ready.
Parameters: None.
Returns:
{
"status": "already_running | started | error | timeout",
"pid": 12345,
"message": "ZeroCreds MCP server is already running."
}Use case: Call this before zerocreds_create_session if you are unsure the server is running. It is idempotent — calling it multiple times is safe.
zerocreds_create_sessionCreates a one-time form session. Returns { token, url, expires_at }.
Claude shows url to the user, then polls zerocreds_check_status every 5–10 seconds.
Parameters:
title (required) — form headingfields (required) — array of { name, label, type?, placeholder?, required?, level? }description — optional subtextdestination — named destination from server config; overrides env defaultttl_minutes — link expiry (default: 30)Field types: text, password, email, tel, number, textarea, url
Field levels (optional, shown to user as privacy indicator): secret · pii · attribute · credential
zerocreds_check_statusPolls session status. Returns { status: "pending" | "done" | "expired" }.
User: "Log me into GitHub"
Claude: [zerocreds_create_session]
title: "Connect GitHub"
fields: [
{ name: "token", label: "Personal Access Token", type: "password" }
]
→ { token: "abc123", url: "https://zerocreds.ru/f/abc123" }
Claude: "Please fill in your token here: https://zerocreds.ru/f/abc123"
[polls zerocreds_check_status every 5s]
→ { status: "done" }
Claude: "GitHub connected! Proceeding..."
[reads token from secret store via configured destination]See zerocreds-server to run your own instance.
| Script | Description |
|---|---|
scripts/ensure-server.sh | Starts the ZeroCreds MCP server if it is not already running. Idempotent. |
scripts/health-check.sh | Verifies the server process is alive and the admin token file exists. |
Run them from the repository root:
./scripts/ensure-server.sh
./scripts/health-check.shOr use the npm scripts:
npm run ensure-start
npm run health-checkMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.