skarbiec mcp

Invocation#

skarbiec mcp

Purpose#

Serve Skarbiec's read-only MCP tools to an agent client over standard input and output.

Required inputs and options#

• No arguments. The client speaks MCP JSON-RPC on stdin and reads answers on stdout.

Output and state effects#

• Answers the skarbiec_health, skarbiec_list, skarbiec_route_resolve, skarbiec_audit, skarbiec_history (saved versions of one item, as history <id>), skarbiec_tags (as tags), skarbiec_grants_reaching (the consumers whose grant reaches one item, as grant list --item <id>), skarbiec_certificates (as certificates, with an optional expiring_before), skarbiec_recipient_items (as recipient items <uid>), skarbiec_duplicates (as duplicates), skarbiec_find (as find <text>, with notes true as find --notes, naming where each item matched, never the value), skarbiec_shares (as shares, the shares that end on their own), skarbiec_unused (with since: grant list --idle-since and list --untouched-since together, under grants and items), skarbiec_expiry (as expiry list, with an optional before), skarbiec_password_age (as password age, with an optional set_before), skarbiec_logins_for (as login list <site>: which login to use on a site, with usernames and never a password), skarbiec_audit_summary (as audit summary, with since and an optional until), skarbiec_review (as review --before <before>, with breached true as --breached; it appends the review journal record the command appends and changes no item), skarbiec_pins (as pin list), skarbiec_codes_missing (as totp missing, downloading only the 2FA Directory's list of sites), skarbiec_site_breaches (as breach sites, downloading only Have I Been Pwned's public list of breaches), skarbiec_password_rules (as password rules <id>, the rules one login keeps and the generator options they ask for), skarbiec_scan (as scan <path> --fields <fields>, with an optional min_length: the files holding a vault value in plain text, by file, line, item and field), skarbiec_token_expiry (as expiry tokens, with an optional before: each stored JSON Web Token's issuer and moments, never the token), skarbiec_exposure (as exposure <id>, with an optional since: the grants reaching one item and the consumers the journal names acting on it, with keys given only as how many open it and whether one here does), skarbiec_rotations (as rotation list, with due true as --due: every rotation policy, what rotates it — a Weles provider and consumer, or the provider rotate --with rotates through and its flags — when it is next due and how the last attempt went; it starts no rotation), skarbiec_credential_helpers (helper status, tool status and doctor's helpers check together, under helpers, tool_tokens and helpers_check: which tools on the server's machine read their credentials from the vault, whether each program they run is there, and the sign-ins still kept in plain text beside them, by tool, file and entry) and skarbiec_bindings_check (as bindings check <file>, with file an absolute path on the server's machine: per line, whether exec would give the variable a value or why not; it appends the bindings-checked journal record) tools from the selected vault. No tool returns a credential value, a bearer, a private key, a fingerprint, a key id or a public key.

Refusals#

• Answers JSON-RPC errors with the standard codes for a line that is not JSON, a request of the wrong shape, a method or tool it does not offer and invalid tool arguments, and a server error carrying the vault's own sentence when a tool fails.