enigmagent-vault

EnigmAgent Vault — Secure Credential Usage

Core principle

Never ask the user for credentials. Never write credentials in tool arguments. Use {{PLACEHOLDER}} references instead — they are resolved to real values after you generate the tool call, before the tool executes.

The LLM (you) writes the placeholder. The gateway injects the real value. You never see it. The user's secrets stay private.

You write:   curl -H "Authorization: Bearer {{GITHUB_TOKEN}}" https://api.github.com
Gateway:     resolves {{GITHUB_TOKEN}} → injects ghp_xxxxxxxxxxxx → runs curl
You receive: the HTTP response body (200 OK, user data, etc.)

---

Placeholder syntax

Pattern	Example	Use case
{{NAME}}	{{GITHUB_TOKEN}}	Any named secret
{{LOGIN:domain}}	{{LOGIN:gmail.com}}	Login password for a domain
{{DOC:filename}}	{{DOC:report.md}}	Full text of a stored document

Names are case-insensitive. Use the exact name shown by enigmagent_vault_list.

---

Step 1 — Check vault is ready

Before any task involving credentials, call:

Tool: enigmagent_vault_status

If running: false: Tell the user:

"The EnigmAgent vault server is not running. Please open a new terminal and run: enigmagent-mcp --mode rest --port 3737 --vault ~/.enigmagent/vault.json Then try again."

Do NOT proceed until the vault is running.

If running: true, unlocked: false: Tell the user:

"The vault server is running but locked. Please restart it: enigmagent-mcp --mode rest --port 3737 --vault ~/.enigmagent/vault.json"

If running: true, unlocked: true: Proceed. All {{PLACEHOLDER}} references will work.

---

Step 2 — Discover available secrets

When you need a credential and are unsure of the exact name, call:

Tool: enigmagent_vault_list

This lists all secrets by name and domain. Use the exact name field as your placeholder. Never guess names — always check the list first.

Example output:

{
  "count": 4,
  "entries": [
    {"name": "GITHUB_TOKEN",      "domain": "localhost"},
    {"name": "OPENAI_API_KEY",    "domain": "localhost"},
    {"name": "LOGIN:gmail.com",   "domain": "localhost"},
    {"name": "DOC_contract.md",   "domain": "localhost"}
  ]
}