vault-ask — Claude Code MCP server: secrets without chat
Hands an agent a password or API key through a one-time link, so the value never lands in the conversation. Also works in reverse.
claude mcp add --env VAULT_ASK_API_KEY=<VAULT_ASK_API_KEY> --env VAULT_ASK_SERVER=<VAULT_ASK_SERVER> --transport stdio cli -- npx -y @erseni/vault-askWhat vault-ask does
The agent gets a link to an Erseni Vault page on stderr. You open it, check which command or file the value is bound to, type it in. What comes back to the agent is metadata only: the name, the length, where it went. Decryption happens locally, and the secret goes to exactly one destination — the environment of a child process via --, a .env file, or a single file with permissions 600.
The send subcommand runs the other way. A value is generated on your machine, encrypted with a fresh AES-256-GCM key, and offered to a person as a once-only link; the same value can also be written to .env or passed to a command, so both sides hold identical bytes. The key sits in the #k= fragment, which means the server keeps ciphertext. Existing values go out with --from-env or --from-file.
For Claude there is a vault-ask-guard PreToolUse hook. It blocks reads of the files vault-ask wrote and refuses to run vault-ask wrapped in env, echo, printf or a similar shell. The hook inspects command text without executing it, so it catches slips, not an agent deliberately hiding a path. An agent running as the same OS user with a shell can still read the memory of processes it spawned; real isolation takes privilege separation. Node.js 20 or newer is required, and VAULT_ASK_API_KEY from your Vault account skips proof of work and puts requests in the dashboard.
What it helps with
- give an agent a database password without pasting it into chat
- write several keys into
.envwith 600 permissions - generate a token and send it to a teammate as a one-time link
- mask a secret inside command output as
*** - stop an agent from reading the file a secret was written to
Example prompts for the agent
- Fetch
DB_PASSWORDand runpsql -h db.example.com -U appwith it - Put
STRIPE_KEYandSENTRY_DSNinto.envusingvault-ask - Generate a 48-character token and send it as a link labelled “Router admin”
How to install vault-ask
Platform CLI
claude mcp add --env VAULT_ASK_API_KEY=<VAULT_ASK_API_KEY> --env VAULT_ASK_SERVER=<VAULT_ASK_SERVER> --transport stdio cli -- npx -y @erseni/vault-askReplace <…> with your own values
Platform CLI
codex mcp add cli --env VAULT_ASK_API_KEY=<VAULT_ASK_API_KEY> --env VAULT_ASK_SERVER=<VAULT_ASK_SERVER> -- npx -y @erseni/vault-askReplace <…> with your own values
Config file
{
"mcpServers": {
"cli": {
"command": "npx",
"args": [
"-y",
"@erseni/vault-ask"
],
"env": {
"VAULT_ASK_API_KEY": "<VAULT_ASK_API_KEY>",
"VAULT_ASK_SERVER": "<VAULT_ASK_SERVER>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"cli": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@erseni/vault-ask"
],
"env": {
"VAULT_ASK_API_KEY": "<VAULT_ASK_API_KEY>",
"VAULT_ASK_SERVER": "<VAULT_ASK_SERVER>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e VAULT_ASK_API_KEY=<VAULT_ASK_API_KEY> -e VAULT_ASK_SERVER=<VAULT_ASK_SERVER> cli npx -y @erseni/vault-askReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about vault-ask
How do I install vault-ask in Claude Code?
Add the MCP server with claude mcp add vault-ask -e VAULT_ASK_API_KEY=<VAULT_ASK_API_KEY> -- npx -y @erseni/vault-ask.
What does vault-ask do?
It asks a person for a value on an Erseni Vault page and delivers it to one destination: a command, a file or .env. The send subcommand does the opposite — generates a value and passes it to a person as a one-time link.
Does the secret show up in chat or in command output?
No. The link goes to stderr, and the value is replaced with *** in the stdout and stderr of the child command, including Base64, URL and hex encodings.
