Knowledge base

Getting started

Key Vault is a centralized, encrypted store for your team's credentials — logins, API keys, Wi-Fi details, credit cards, identities, and secure notes. This guide walks you through the essentials and how to let AI assistants read your vault safely.

1. Create your account. Sign in and Key Vault provisions a personal vault for you automatically.
2. Add items. Open the Vault page and add logins, API keys, or notes. Sensitive fields are encrypted in your browser before they ever reach the server.
3. Organize. Use folders, tags, and favorites to keep everyday credentials within reach.
4. Invite your team. Create an organization, add members, and group credentials into shared vaults by department or project.

Connect AI assistants (MCP)

Key Vault exposes a Model Context Protocol server so AI assistants can list and search your vault. It runs in OAuth mode — assistants never see your password; they receive a short-lived token after you approve access.

Server URL

https://vault.cloudsolutions.com.fj/api/mcp

Connect it in Claude.ai: Settings → Connectors → Add custom connector, paste the URL, and approve the consent prompt.

Connect it in the Claude desktop app by adding this to your config (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "key-vault": {
      "type": "url",
      "url": "https://vault.cloudsolutions.com.fj/api/mcp"
    }
  }
}

The same URL works with ChatGPT, Cursor, and any client that supports remote MCP servers over Streamable HTTP.

Available tools

• list_vault_items — Lists the credentials you can access, with metadata. Optionally filter by vault or item type.
• get_vault_item — Retrieves a single vault item by id, including its (encrypted) sensitive fields.
• search_vault_items — Searches your accessible items by name, username, URL, or service name.
• list_vaults — Lists your personal and organization shared vaults.

Security & encryption

Sensitive fields — passwords, API keys, card numbers, and the like — are encrypted in your browser with AES-GCM before they are sent to the server. The server stores ciphertext and never holds the decryption key, so it cannot return plaintext secrets to anyone, including AI assistants.

• Your master password derives a key locally via PBKDF2; it never leaves your browser.
• All vault reads and writes pass through a tenant-aware backend that enforces the same isolation as the app.
• MCP tools are read-only — assistants can list and search, but cannot create, edit, or delete records.

Team & organization vaults

An organization groups your team under a single tenant. Company admins manage shared vaults and members; members see only the vaults they belong to. Personal vaults always stay private to their owner.

• Owner — full control of the organization and billing.
• Company admin — manages members and shared vaults.
• Member — accesses vaults they are added to.

Secure sharing

Share a credential with an expiring link instead of pasting it into chat. Each share can be password-protected, limited to a set number of views, and given an expiry date. Failed password attempts are rate-limited and lock the share after repeated guesses.

Open any vault item, choose Share, and copy the generated link. Recipients open it in a browser and unlock it with the password you set.

Frequently asked questions