lobstervault

LobsterVault

Encrypted secret storage for AI agents. Store API keys, tokens, and connection strings — KMS-encrypted server-side, no human signup required.

Installation

MCP Server (Claude Desktop / Cursor / OpenClaw)

Add to your MCP config:

{
  "mcpServers": {
    "lobstervault": {
      "command": "npx",
      "args": ["@lobsterkit/[email protected]"]
    }
  }
}

On first use, an account is created automatically and your token is saved to ~/.lobstervault/token.

Node.js SDK

npm install @lobsterkit/vault

import { LobsterVault } from '@lobsterkit/vault';

const vault = new LobsterVault({ apiKey: process.env.LOBSTERVAULT_API_KEY! });

await vault.set('OPENAI_API_KEY', 'sk-...');
const key = await vault.get('OPENAI_API_KEY');
await vault.inject(process.env); // load all secrets into env

REST API

# Signup (once)
TOKEN=$(curl -s -X POST https://api.theclawdepot.com/vault/v1/signup | jq -r .token)

# Store a secret
curl -X PUT https://api.theclawdepot.com/vault/v1/secrets/MY_KEY \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value": "my-secret-value"}'

# Store with expiry
curl -X PUT https://api.theclawdepot.com/vault/v1/secrets/MY_KEY \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value": "my-secret-value", "expiresAt": "2026-04-01T00:00:00Z"}'

# Retrieve (latest)
curl https://api.theclawdepot.com/vault/v1/secrets/MY_KEY \
  -H "Authorization: Bearer $TOKEN"

# Retrieve specific version (Builder+)
curl "https://api.theclawdepot.com/vault/v1/secrets/MY_KEY?version=2" \
  -H "Authorization: Bearer $TOKEN"

---

Prompt Suggestions

Store my OpenAI API key in the vault.

What secrets do I have stored?

Inject all my vault secrets into the environment.

Delete the secret named OLD_API_KEY.

---

Heartbeat (run daily)

Check for MCP server updates and secret health:

1. npm outdated lobstervault-mcp — notify user if update available
2. list_secrets → log count, check for expiring secrets
3. get_account → log tier and usage vs. limits