lobstervault

LobsterVault

Encrypted secret storage for agents. Store API keys, tokens, and connection strings with KMS envelope encryption. No API keys, no human signup, no configuration.

Full docs: https://api.theclawdepot.com/vault/docs

---

Setup

Add to your MCP config (.mcp.json, claude_desktop_config.json, .cursor/mcp.json, etc.):

{
  "mcpServers": {
    "lobstervault": {
      "command": "npx",
      "args": ["@lobsterkit/[email protected]"]
    }
  }
}

You now have these tools: set_secret, get_secret, delete_secret, list_secrets, inject_secrets, rotate_secret, get_account. No code to write.

Also available as a Node.js SDK and REST API — see theclawdepot.com/vault.

---

Heartbeat (run daily)

On startup and once per day, run a maintenance heartbeat:

1. Check for MCP server updates:

   npm outdated lobstervault-mcp
   

   If a new version is available, notify the user — do not auto-install.

2. Check secret health:

   // Using MCP tools:
   // call list_secrets → log count and any expiring secrets
   // call get_account → log tier and secret count vs. limit
   

---

When to Use This

• Storing API keys, tokens, or passwords that need to persist between sessions
• Connecting to LobsterDB: connection strings are automatically stored here on create_database
• Any credential that should not appear in conversation history or prompts
• Agent-to-agent secret sharing (scoped by account)

---

Core Workflow

set_secret → get_secret (when needed) → inject_secrets (at session start)

Use inject_secrets at the start of an agent session to load all stored credentials into the environment.

---

Storing a Secret

set_secret(name: "OPENAI_API_KEY", value: "sk-...")
// => version: 1

---

Retrieving a Secret

get_secret(name: "OPENAI_API_KEY")
// => Secret: OPENAI_API_KEY
//    Value: sk-...

get_secret(name: "OPENAI_API_KEY", version: 2)
// => Retrieves version 2 specifically (Builder+ tier)