MCP Server

This is what decides whether you should install this at all, and which tool to reach for once you have. The two tools have very different trust properties.

create_secret does not make anything worse, because the caller already typed the secret into the conversation, but the transcript keeps it.

generate_secret produces the value locally and puts the link password on the clipboard, so the conversation holds only a URL, which is useless on its own.

Two ways to run this, and they are not equivalent.

stdio runs npx -y @clouddrove/vanisec-mcp on your own machine. You get both tools, and encryption happens locally, so Vanisec only ever receives ciphertext. Requires Node 22 or newer.

Hosted points a client at https://vanisec.clouddrove.com/api/mcp. It encrypts server side and offers vanisec_create_secret only. Use it only when the client cannot run a local process, and read the hosted endpoint section below first.

One server, four different top-level keys

Getting the key wrong is a silent no-op: the client starts, the server never loads, and nothing tells you why. Each block below leads with its key.

Claude Code

claude mcp add vanisec -- npx -y @clouddrove/vanisec-mcp

Claude Desktop

Settings, Developer, Edit Config opens claude_desktop_config.json, at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS and %APPDATA%\Claude\claude_desktop_config.json on Windows. Key mcpServers.

{
  "mcpServers": {
    "vanisec": {
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"]
    }
  }
}

Docs: modelcontextprotocol.io

Cursor

.cursor/mcp.json for one project, ~/.cursor/mcp.json for every project, project config winning. Key mcpServers. Turn the server on from Customize in the sidebar.

{
  "mcpServers": {
    "vanisec": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"]
    }
  }
}

Cursor's field table marks type as required for stdio while none of its examples include it. Including it is harmless. For the hosted endpoint, which is server side encryption and vanisec_create_secret only, leave type out, because Cursor documents no allowed values for it on a remote server.

{
  "mcpServers": {
    "vanisec": {
      "url": "https://vanisec.clouddrove.com/api/mcp"
    }
  }
}

Docs: cursor.com/docs/context/mcp

VS Code with GitHub Copilot

The key is servers. mcpServers is not accepted in .vscode/mcp.json. On a Copilot Business or Enterprise seat, read the org policy note below first, because nothing works until an admin acts. .vscode/mcp.json covers the workspace; for a user level file run MCP: Open User Configuration from the command palette, since VS Code publishes no path for it. settings.json is no longer the mechanism.

{
  "servers": {
    "vanisec": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"]
    }
  }
}

Hosted, which is server side encryption and vanisec_create_secret only. Use type: "http", since sse is legacy.

{
  "servers": {
    "vanisec": {
      "type": "http",
      "url": "https://vanisec.clouddrove.com/api/mcp"
    }
  }
}

From a terminal, where a name key appears that does not exist inside mcp.json:

code --add-mcp "{\"name\":\"vanisec\",\"command\":\"npx\",\"args\":[\"-y\",\"@clouddrove/vanisec-mcp\"]}"

Agent Host does not read .vscode/mcp.json. Its portable config is a workspace .mcp.json or ~/.copilot/mcp-config.json, both keyed mcpServers.

Docs: code.visualstudio.com

GitHub Copilot, other surfaces

Start here. The organization and enterprise policy MCP servers in Copilot is disabled by default for Copilot Business and Enterprise seats. Until an admin enables it, nothing below works in any Copilot surface, including VS Code, and the failure does not explain itself. It does not apply to Free, Pro, Pro+ or Max. Policy docs.

Cloud agent and code review. Configured under repository Settings, Copilot, MCP servers, not in a file. Key mcpServers, with tools and type both required. There is no local process here, so it is the hosted endpoint or nothing: server side encryption and vanisec_create_secret only, on a surface where the secrets being handled are rarely trivial. It also runs MCP tools without approval prompts, the opposite of every interactive client, so allowlist the specific tool rather than "*". Naming the one tool we expose costs nothing and keeps the allowlist from silently widening later.

{
  "mcpServers": {
    "vanisec": {
      "type": "http",
      "url": "https://vanisec.clouddrove.com/api/mcp",
      "tools": ["vanisec_create_secret"]
    }
  }
}

GitHub states the cloud agent supports tools only, not resources or prompts. OAuth remote servers are not supported, so use a static header if you need auth. Secrets must be Agents secrets named with a COPILOT_MCP_ prefix. Docs.

Copilot CLI. Key mcpServers, in ~/.copilot/mcp-config.json, .mcp.json or .github/mcp.json. It does not read .vscode/mcp.json and reports an unsupported top-level key servers if you point it there. Every MCP tool call needs explicit permission, even read-only ones, which is the opposite of the cloud agent.

jq '{mcpServers: .servers}' .vscode/mcp.json > .mcp.json

copilot mcp add vanisec -- npx -y @clouddrove/vanisec-mcp
copilot mcp add --transport http vanisec https://vanisec.clouddrove.com/api/mcp

The last line is the hosted endpoint: server side encryption, vanisec_create_secret only. Docs.

JetBrains, Visual Studio, Xcode, Eclipse. All supported, all keyed servers. GitHub never publishes a path for these files, saying only that it varies by IDE, so add the server through the UI. In JetBrains: Copilot icon, Open Chat, Agent mode, tools icon, Add MCP Tools. Minimum versions: JetBrains plugin 1.5.53 or newer for remote servers, Visual Studio 2022 17.14, Xcode 0.41.0, Eclipse plug-in 0.10.0. The block below is the hosted endpoint, so server side encryption and vanisec_create_secret only. Install the package with stdio instead if the IDE can run a local process.

{
  "servers": {
    "vanisec": {
      "url": "https://vanisec.clouddrove.com/api/mcp"
    }
  }
}

If you need to send a header, JetBrains, Xcode and Eclipse nest it under requestInit, not a top level headers key. Visual Studio uses a plain url with OAuth instead.

{
  "servers": {
    "vanisec": {
      "url": "https://vanisec.clouddrove.com/api/mcp",
      "requestInit": {
        "headers": { "Authorization": "Bearer TOKEN" }
      }
    }
  }
}

Docs: docs.github.com. github.com web chat and Copilot Spaces are not supported at all: both use a preconfigured GitHub MCP server that cannot be changed.

Codex

~/.codex/config.toml for you, .codex/config.toml for a project, and the project file is read only when the project is trusted. The table name is [mcp_servers.vanisec], snake_case, not mcpServers. The IDE extension reads the same file.

Set startup_timeout_sec = 30. The default is 10 seconds and an npx -y cold start routinely exceeds it. The symptom is the server failing to start with no useful explanation, and it is the single most common way this install goes wrong.

[mcp_servers.vanisec]
command = "npx"
args = ["-y", "@clouddrove/vanisec-mcp"]
startup_timeout_sec = 30

Hosted, which is server side encryption and vanisec_create_secret only:

[mcp_servers.vanisec]
url = "https://vanisec.clouddrove.com/api/mcp"
startup_timeout_sec = 30

codex mcp add vanisec -- npx -y @clouddrove/vanisec-mcp
codex mcp add vanisec-remote --url https://vanisec.clouddrove.com/api/mcp

Inline bearer_token is gone, replaced by bearer_token_env_var, and experimental_use_rmcp_client is unnecessary now that streamable HTTP is first-class. Docs: learn.chatgpt.com/docs/codex/cli

Windsurf and Devin

The Devin rebrand split the config in two, so the file depends on the surface. Legacy Cascade uses ~/.codeium/windsurf/mcp_config.json, the Windsurf plugin for VS Code and JetBrains uses ~/.codeium/mcp_config.json, and Devin Local uses ~/.config/devin/mcp_config.json or .devin/mcp_config.json. All four use mcpServers, and stdio is identical in all of them.

{
  "mcpServers": {
    "vanisec": {
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"]
    }
  }
}

The remote form differs, and both are the hosted endpoint: server side encryption, vanisec_create_secret only. Cascade uses serverUrl and takes no transport key. Devin Local uses url with an optional transport, defaulting to http.

{
  "mcpServers": {
    "vanisec": { "serverUrl": "https://vanisec.clouddrove.com/api/mcp" }
  }
}

{
  "mcpServers": {
    "vanisec": {
      "url": "https://vanisec.clouddrove.com/api/mcp",
      "transport": "http"
    }
  }
}

Cascade caps out at 100 tools across all servers. Docs: docs.devin.ai

Zed

~/.config/zed/settings.json, key context_servers. Add it from Settings, AI, MCP Servers, Add Server. The old "source": "custom" discriminator is gone, and a project level .zed/settings.json for context servers is not documented, so use the user file.

{
  "context_servers": {
    "vanisec": {
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"],
      "env": {}
    }
  }
}

Hosted, which is server side encryption and vanisec_create_secret only. Zed accepts only url and headers on a remote server.

{
  "context_servers": {
    "vanisec": { "url": "https://vanisec.clouddrove.com/api/mcp" }
  }
}

Tool permissions are keyed mcp:vanisec:<tool_name>. Docs: zed.dev/docs/ai/mcp

vanisec_create_secret

Uploads a secret whose text and password you provide directly. Use this when the secret already exists somewhere, such as an API key you are handing off.

vanisec_create_secret(text, password, expiresIn?)

• text: the secret content
• password: required, chosen by the caller
• expiresIn: hours, one of 1, 6, 24, 72, 168, default 24

Example prompt: "Share this deploy key with password hunter2 as a one-time link."

vanisec_generate_secret

Generates a random password, token, or hex string locally, uploads it, and copies the link password to your clipboard. Use this whenever the value itself can be random, which covers most credential hand-offs.

vanisec_generate_secret(type, length?, expiresIn?)

• type: password, token, or hex
• length: password default is 24, range 12 to 128; token default is 32, range 16 to 128; hex default is 64, range 16 to 256, even lengths only
• expiresIn: hours, one of 1, 6, 24, 72, 168, default 24

Example prompt: "Generate a 32 character token and give me a one-time link."

Two prompts ship with the server, for the cases where picking the wrong tool is the actual risk. share-credential points at vanisec_generate_secret when the credential does not exist yet and falls back to vanisec_create_secret only when it already exists elsewhere. rotate-and-share adds the ordering: hand over the replacement, wait for the recipient to confirm it works, revoke the old value only after that.

Which clients can reach them

Mostly none of them. Several vendors declare prompt support in a capability table and then document no way for a user to invoke one. Rows below come from each vendor's own docs, checked 2026-08-20, and cover the clients in the install matrix above.

VS Code is the only client with a documented, user-reachable prompt surface. Declared supported means the vendor lists prompts as a supported MCP feature but publishes no invocation surface, so treat those three as unreachable until they document one.

That is why the two tool descriptions repeat the guidance the prompts give: it is the only channel every client reads. Tracking issue #112.

Point the server at your own Vanisec instance by setting VANISEC_BASE_URL in the config's env block:

{
  "mcpServers": {
    "vanisec": {
      "command": "npx",
      "args": ["-y", "@clouddrove/vanisec-mcp"],
      "env": {
        "VANISEC_BASE_URL": "https://your-instance.example.com"
      }
    }
  }
}

generate_secret relies on a system clipboard to hand you the link password without it passing through the conversation. Over SSH or inside a container there may be no clipboard available, and in that case the tool fails rather than falling back to revealing the password in the conversation.

Set VANISEC_ALLOW_INLINE_PASSWORD=1 to opt into that degraded behaviour if you understand the trade-off and need it anyway.