How does the ApiVault MCP server work?

ScriptMasterLabs · November 1, 2026

The ApiVault MCP server is a remote Model Context Protocol server at https://mcp.apivault.tech/mcp that lets AI assistants browse, manage and decrypt vault secrets with OAuth 2.1 scoped authorization (ApiVault MCP documentation, last updated November 1, 2026).

The ApiVault MCP server is a remote Model Context Protocol server at https://mcp.apivault.tech/mcp that lets AI assistants browse, manage and decrypt vault secrets with OAuth 2.1 scoped authorization (ApiVault MCP documentation, last updated November 1, 2026). ScriptMasterLabs' live gate test on November 1, 2026 measured the two irreversible acts in its 6-tool surface: in scope form the SML harness auto-acted "reveal the raw secret value for a key" at 0.8333 and "permanently delete a key from the vault" at 0.8571 — both cleared the 0.80 auto-act bar, and the permanent delete scored higher than the reveal — while ApiVault's own design gates those acts only at connect time, by OAuth scope and project role, with 0 per-action confirmation steps named for a reveal or a delete.

That connect-time design is unusually complete, and the counts below show it. ApiVault binds each authorization token permanently to one selected Target Project, splits permission into 3 OAuth scopes, and layers 3 project roles on top. What it does not do — in the documentation read November 1, 2026 — is score or confirm any single act: once a client holds keys:reveal or keys:write for a project, a reveal decrypts the raw secret and a delete removes the key permanently, with the audit log recording the act after it happens.

The counted surface (ApiVault's own documentation, read November 1, 2026)

Every count below is from ApiVault's MCP documentation and its Tools & scopes page, both marked last updated November 1, 2026, and read the same day. SML counted the tool and scope tables row by row.

Two honesty notes ride with the table. First, ApiVault's security guidance is explicit and good: request only the scopes a task needs, rely on masked previews before requesting raw secrets, never print revealed secrets into conversation transcripts, and disconnect inactive agents in Settings → MCP Connections. The workflow pattern in the docs is itself a three-step discipline — list, verify metadata, reveal only when the raw secret is required. Second, none of that guidance is an enforced per-action check in the material read: it is advice to the operator and the agent, while the enforced layers are scope, role and project binding at connect time. What SML tested is its own gate reading ApiVault-shaped instructions, below — SML did not test ApiVault's production systems and holds no ApiVault account for this test.

Why a secrets reveal is a decision-gate problem?

A payment can be refunded. A revealed secret cannot be un-revealed: once reveal_key returns the raw value into an agent's context, the disclosure has happened, whatever the transcript does next. A permanent delete is the mirror image: the credential is gone, and any system still depending on it fails until it is replaced. These are the two acts in the MCP economy where "audit it afterwards" is weakest, because the log records an irreversible fact.

The decision-gated pattern scores the act before it fires: a confidence score gates the action at >=0.80 auto-pay / auto-act, 0.50–0.79 confirm, <0.50 escalate to a human (canonical: https://scriptmasterlabs.com/decision-gated-payments). The test below asks whether that score draws ApiVault's own implied line — masked reads clear, a confirmed reveal confirms, an unconfirmed reveal-plus-delete never clears.

The live gate test (November 1, 2026)

Method, stated once for the whole table: the SML harness at scriptmasterlabs.com/api/harness, decider local-heuristic-v1, calibrated=false, bands >=0.80 auto-act / 0.50–0.79 advisory / <0.50 escalate, status endpoint verified live the same minute. Bounded state: $10 budget, $1 per-transaction cap, allowlist of "list keys with masked previews" + "get key metadata". Every value below was verified identical across two full probe executions, read from the probe file on disk (probe-apivault-1101.out) before any number was written.

Read the table in full, because the finding is the whole pattern, not one cell:

• Both irreversible acts cleared the bar in scope form — and the delete scored highest of the two. Neither reveal nor delete was on the allowlist, and both auto-acted: reveal at 0.8333, permanent delete at 0.8571. A scored gate of this design, placed in front of ApiVault's tools, would wave through the two acts that cannot be undone, in the form that is usually this gate's most conservative shape. ApiVault's connect-time scope wall is — on this evidence — the load-bearing control today, precisely because it refuses out-of-scope calls outright instead of scoring them.
• The sentence form held both reveal sentences, but could not tell them apart. The confirmed, purpose-stated reveal ("for the key I confirmed by ID, for a local build") held at 0.7778 advisory, and the unconfirmed reveal-plus-delete ("without asking me first") held at 0.7632 — a gap of 0.0146 between a legitimate disclosure and a destructive one. The hold is the right outcome for both; the near-identical scores mean the gate is holding reveal-shaped sentences generally, not reading the confirmation.
• The bounded-context collapse is unchanged. With environment-only state, all three scopes fell to 0.50 advisory — the read's 0.9545 discrimination exists only while the bounded state is present in the request.
• The score form still discriminates nothing. All three scopes escalated at 0.35 under both phrasings.

The honest caveat, carried on every piece in this series: the decider is a local heuristic, calibrated=false, and these scores measure how this gate reads these instructions — they are not a claim about ApiVault's production systems, which SML did not test. What the test establishes is narrower and still useful: for secrets, the enforced line today is the scope-and-role wall at connect time plus operator discipline afterwards, and a scored layer earns a place in front of reveal_key and delete_key only when it can hold both below the auto-act bar in every form — starting with scope form, where this gate failed in the dangerous direction.

Same-minute Verdict re-verification

The decision layer SML sells was re-probed in the same run: Verdict Protocol /health returned 200 in 0.87s; /.well-known/agent.json reported LIVE_SETTLEMENT_VERIFIED in 0.90s; a no-payment POST to /decide returned HTTP 402 in 0.91s quoting 250000 atomic USDC ($0.25) on Base, payTo the xPortal wallet from the October 30, 2026 payTo swap. Verdict is the scored-decision complement at the reveal boundary: a 5-juror decision receipt for $0.25 USDC, or a $0.01 seal, recorded before the act it judges — the per-act record ApiVault's audit log writes only after a failed call, written before a successful irreversible one. ApiVault and Verdict Protocol are products of unrelated companies; the connection is architectural, not commercial.

Do it yourself?

1. Read ApiVault's Tools & scopes page before connecting anything: the 6 tools split cleanly into masked reads, one reveal, and three writes — grant keys:read first and add keys:reveal or keys:write only for a named task, exactly as ApiVault's least-privilege guidance says.
2. Keep the Viewer role for routine agent work: under ApiVault's RBAC a Viewer agent can read metadata only, and write attempts are rejected regardless of granted scopes — that rejection is stronger than any scored hold measured above.
3. Follow the docs' own three-step workflow in fact: list with masked previews, verify the key's metadata by ID, and reveal only when a local build or test actually requires the raw value — never into a conversation transcript.
4. Put a scored gate in front of the reveal and the delete — which key, for what purpose, confirmed by whom — so the one irreversible step in the workflow carries a decision record made before it fires: https://scriptmasterlabs.com/verdict-protocol

Canonical: https://scriptmasterlabs.com/apivault-mcp-server
Related: https://scriptmasterlabs.com/verdict-protocol · https://scriptmasterlabs.com/decision-gated-payments · https://scriptmasterlabs.com/ai-agent-spend-gate · https://scriptmasterlabs.com/the-fourth-layer