MCP Endpoint
Reference for POST /api/agents/mcp — the MCP server exposing list_credentials and get_credential tools, with tvagent_ key or OAuth 2.1 session auth.
POST /api/agents/mcp
Token Vault's own MCP server. Any MCP client (Claude Code, Claude.ai, ChatGPT, Cursor) can connect over streamable HTTP and use standard tool calls to work with the agent's granted credentials.
claude mcp add --transport http token-vault https://api.tokenvault.uk/api/agents/mcpAuthentication
Two interchangeable identities — both resolve to the same agent, grants, and policies:
- OAuth 2.1 (recommended for MCP clients) — the client discovers Token Vault's authorization server from a
401, registers itself, and obtains atvsess_…session token in-client. No key is pasted anywhere. See OAuth 2.1 for MCP Clients. - Static key —
Authorization: Bearer tvagent_…for server-side agents you configure by hand.
Tools
| Tool | Arguments | Returns |
|---|---|---|
list_credentials | — | The agent's active grants (service names, expiry, refresh policy) — no credential material |
get_credential | service | A signed, short-lived credential URL pointing at your webhook's /v1/credential |
Why a URL and not the credential?
The MCP transport runs through Token Vault, and Token Vault never carries credential bytes. get_credential therefore returns a one-time signed URL; the agent fetches it and receives the credential directly from your webhook — the same custody path as the REST endpoint's 307 redirect.
Policies and revocation
ABAC policies attach to the agent identity, not the transport — time windows, IP allowlists, rate limits, and manual approval all apply to MCP tool calls exactly as to REST. Suspending the agent kills both paths; for OAuth sessions, every token refresh re-checks agent status, and POST /api/mcp-oauth/revoke kills a session immediately.
Ready to try it?
Sign up free with Google — your credentials stay on your own webhook, and the quickstart gets an agent fetching its first credential in about ten minutes.
Agent Credentials API
Reference for GET /api/agents/credentials — auth forms, the 307 redirect contract, list mode, response schemas, and the full error catalogue.
MCP Proxy Endpoint
Reference for POST /api/proxy/mcp — proxy key auth forms, webhook credential injection, and the tv_session upstream auth type.