Store your keys once.
Every agent you run can use them.
BotVault keeps your API keys, passwords, and connections in one encrypted vault. Claude Code, Cursor, and hosted agents fetch them at runtime, scoped per agent, with every read audited. No more secrets living in prompts or pasted into chat.
https://mybotvault.com/api/mcpPaste it into your agent's connector settings. Not a terminal command.
The problem
Stop pasting API keys into chat windows.
Every key you paste into a prompt gets stored in history, logged by the platform, and echoed into every follow-up. Your agents don't need to see the key. They need to use it.
> deploy the billing fix to prod
> here is the stripe key:
sk_live_4eC39HqLyjWD...
> now stored in history, logs, and every reply
> deploy the billing fix to prod
> fetching credential by reference
botvault://stripe/live · resolved at runtime
> no key saved in this conversation
How it works
From pasted secrets to runtime references.
Store once
Add your API keys, passwords, cards, and Google accounts to your vault. Once. Encrypted at rest.
Connect your agent
One command installs the MCP server and pairs the device. Hosted agents get a skill or a token instead.
Keys resolve at runtime
When a task needs a credential, the agent fetches it by reference. The value resolves inside the vault, at that moment.
Connect
Three ways in, one set of permissions
Whatever your agent is, it reaches exactly what you allowed it to reach. Take the first one that works.
Built for Claude Code, Cursor, OpenClaw, and anything that speaks MCP or HTTP.
What you can store
One vault for everything your agents need.
API keys & tokens
Stripe, OpenAI, GitHub, or anything with a secret string.
Passwords
Site logins your agents use on your behalf.
Payment cards
Card details for agent-driven purchases, masked everywhere.
Google accounts
Scoped OAuth grants for Gmail, Calendar, Drive, and more.
Security
Built like a vault, audited like a ledger.
Envelope encryption
AES-256-GCM with a unique key per credential, wrapped by a key derived per user.
Fetched at use, not stored
Values are fetched at the moment of need and never stored in prompts, transcripts, or config. Agents are instructed to use them without echoing them back.
Per-agent access
Each bot gets its own token, its own permissions, and its own revocation switch.
Every read logged
Every fetch is written to your audit log with the bot's identity and timestamp.
Pricing
Free to start. Nine dollars when you outgrow it.
Flat price. Not per agent, not per seat.
FAQ
Questions, answered.
They secure teams and infrastructure. BotVault is a personal vault whose front door is MCP, built for the agents you run yourself.
Values resolve inside the vault at request time and are returned to the tool runtime, so the key never needs to appear in the conversation. The skill also instructs agents never to print, log, or echo credential values.
Use the pasteable skill or the REST API with a bearer token. Anything that can make an HTTP call works.
Each credential is encrypted with AES-256-GCM under its own key, wrapped by a key derived per user from a master secret. The server holds that master secret so it can serve your agents at runtime, so treat BotVault like a hosted password manager, not a zero-knowledge system.
API keys and tokens, passwords, payment cards, and Google accounts connected over OAuth. Free accounts include 5 keys, 5 passwords, 5 cards, 1 Google account, and 1 bot.
Nothing breaks. Existing credentials keep serving your agents. You just can't add more until you upgrade.