Loading ToolBench
MCP server for Stillvault — human-approved secret release for AI agents, without the secret entering the model's context.
Stillvault MCP demonstrates strong naming, comprehensive parameter descriptions, and clear security-focused design. Both tools follow verb_noun convention (stillvault_run, stillvault_reveal) with explicit, actionable descriptions (194 - 250 chars each). Input schemas are fully typed with Zod validation. However, output schemas are not formally documented, responses are text-only without structured field definitions. Error handling is present but lacks recovery guidance for some failure modes. The server correctly avoids exposing secrets as parameters, using environment injection instead, a critical security pattern.
Returns a secret's plaintext VALUE into this conversation after a named human approves the release. WARNING: this puts the secret in the model's context and therefore in your LLM provider's logs — it is the opposite of how Stillvault is meant to be used. Prefer stillvault_run, which uses the secret without revealing it. Use this only when the value itself must be read (e.g. to display it to the human who asked, or to write it into a file you are editing). The call blocks until a human approves on their device.
PREFERRED way to use a secret. Runs a local command, resolving any `stillvault://<path>` references after a named human approves the release. The secret is injected into the child process and is NEVER returned to you or shown in this conversation — you get only the command's output. The call blocks until a human approves on their device (or times out). Examples: run `psql` with `stillvault://db/prod/dsn` as an argument, or `curl` an API with a key in a header. Prefer this over stillvault_reveal whenever you just need to *use* the secret rather than read its value.
Output schemas not formally documented. Both tools return text-only responses without structured field definitions. LLMs cannot plan downstream operations or extract typed data.
Error responses lack recovery guidance. Timeout and spawn errors return hints, but partial failures (e.g., one secret release fails, others succeed) are not addressed. No per-item success/failure reporting.
No idempotency guarantees documented. stillvault_run modifies state (executes commands) but does not declare idempotency or retry safety. Agents may double-execute on transient failures.
secret_env parameter uses additionalProperties without value constraints. LLMs could pass arbitrary environment variable names or malformed references. Should validate that values contain stillvault:// references.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). stillvault_reveal is read-only; stillvault_run is destructive. Annotations would help LLMs reason about side effects and retry safety.