Connect an AI tool to the vault

Remote MCP lets a hosted AI tool reach your synced secrets vault without a local CLI. The tool can find secrets, describe them, set and delete them, ask for access, and run a program you approved with a secret. It never receives a secret value.

What the server sees

The vault server stores no plaintext and holds no vault key, but a remote MCP call is not end-to-end encrypted: plaintext passes through the server's memory after TLS ends. That is the value an AI tool sends with a set, until the server seals it or relays it to your device, and the names, metadata and redacted run output your device sends back on their way to the AI tool. It is never logged, stored or put in an error. AI tools do not check device signatures, so they trust the server for what a result says. See ADR 0002, decision D7.

Sign-in and scopes

Every client below follows the same flow. It finds the sign-in server through /.well-known/oauth-protected-resource/mcp, registers itself, and opens agentkit.best in your browser. You sign in there and approve the access it asks for. There is no API key to paste. The grant lasts 30 days, after which the client asks you to sign in again.

Keep a device online

Reads, request and run are answered by one of your own devices that holds a relay connection open. That device decrypts locally, applies its own grants and approvals, and answers. Run this on it and leave it running:

ak secrets sync now --watch --relay

The relay needs an ak build that includes it (v3.0.0-beta.36 or later). It works only with --watch, keeps a connection to the vault server open beside the sync loop, and also applies writes queued while no device was online. Each call the server forwards runs on that device, and the result goes back signed with the device key. Nothing prompts on the device. A compromised vault server could forge the writes the relay applies, so an AI agent may not start it: --relay run by an agent exits 6. Plain ak secrets sync now stays open to agents.

• Status. The command prints relay: connected, relay: reconnecting or relay: stopped(<reason>). A relay problem never stops the sync loop, and other failures reconnect on their own.
• What each tool does there. search, list and describe return names and profile fields from the local index and never read a value. set and delete write this device's store and sync at once, but only on a human owner or editor device and not while a rekey is pending; otherwise they answer denied and nothing is written. A write to a secret with a local edit not pushed yet, or to the name of a new local secret not pushed yet, answers conflict and leaves the local change in place; retry after the next sync cycle. request files an approval for ak secrets approve, where the client shows as mcp:<client id>, and answers pending until you answer it. run starts a program only when an exec grant already pinned on this device covers every variable (see Run a program with a secret); otherwise it files a request and answers pending_approval.
• Output. run output has the released values struck out. Output a program encoded, split or printed in part is not caught.
• Deletes. Remote deletes count against the mass-delete guard with this device's own deletions. Start the relay with --allow-mass-delete to let a larger batch through.
• Audit. Each call is recorded in the vault's encrypted audit log with the tool, the client and the outcome, never a value or an argument.

ak secrets sync now --help lists every flag and exit code.

When no device is online

• Reads, request and run answer no_device_online.
• set and delete must name the vault_id. The server seals the operation to your vault's seal key and queues it (status queued) until one of your devices applies it as a normal signed write. The queue is write-only: nothing reads a queued value back. It works only for an owner or editor of the vault, only after an owner device has published the seal key, and not while a rekey is pending. A full queue answers sealed_queue_full.

The server cannot read a sealed write, but a compromised server can forge one. A device applies queued writes only while it runs the relay or after you opted it in with ak secrets sync enable --accept-sealed, which an AI agent cannot run. Watch ak secrets sync now for sealed writes you did not expect.

Call budgets per AI tool and per account, relay deadlines, and the queue size and lifetime are owned by worker/src/limits.ts and published by GET /v1/meta on the vault server.

Add the server to your AI tool

Each client keeps its own settings, and their menu names change between releases. If a step below no longer matches, look for the client's remote (HTTP) MCP server or custom connector setting and give it the same URL.

Claude Code

claude mcp add --transport http ak-vault https://vault-staging.agentkit.best/mcp

Then run /mcp in a Claude Code session, pick ak-vault, and choose Authenticate to sign in through agentkit.best.

Claude.ai

Open Settings → Connectors, choose Add custom connector, and enter https://vault-staging.agentkit.best/mcp as the URL. Choose Connect to sign in through agentkit.best. On a Team or Enterprise plan, an owner may have to add the connector first.

ChatGPT

Custom MCP connectors need developer mode. Turn it on under Settings → Apps & Connectors → Advanced settings, then create a connector with the URL https://vault-staging.agentkit.best/mcp and OAuth authentication. ChatGPT opens agentkit.best to sign in.

Cursor

Add the server to .cursor/mcp.json in a project, or to ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "ak-vault": {
      "url": "https://vault-staging.agentkit.best/mcp"
    }
  }
}

Cursor lists the server under its MCP settings; choose its sign-in prompt to authenticate through agentkit.best.

VS Code

Add the server to .vscode/mcp.json in your workspace:

{
  "servers": {
    "ak-vault": {
      "type": "http",
      "url": "https://vault-staging.agentkit.best/mcp"
    }
  }
}

Start the server from that file or the MCP: List Servers command. VS Code asks you to sign in through agentkit.best, and the tools appear in Copilot Chat's agent mode.

Disconnect

In your AgentKit account, open Connected apps and disconnect AgentKit Vault (AI tools). The next request with that grant is refused. Removing the server from the client alone does not end the grant.

To stop a device answering calls, stop the --watch --relay command on it.