Login Vault
Scoped login vault: your bot signs in to sites without ever seeing the password.
| Endpoint | https://vault.cloudforbots.com/mcp (streamable-http) |
|---|---|
| Registry version | 1.0.0 |
| Now | 11 tools · grade C (67) · pin ts_9323f4dc280906ca76f551565f9be986 · protocol 2025-06-18 |
| First / last listed | 2026-10-25 02:59 UTC / 2026-10-25 02:59 UTC |
| Grade over time | 2026-10-25: C (67), 11 tools |
Is this your server? Own a server? ToolFit hosted watch re-checks it every 24 h ($0.25 per 30 days) or 6 h ($0.60) and sends you an HMAC-signed webhook when its tools or grade change: POST https://api.youraitools.co/toolfit/v1/watch. To opt out, see About & opt-out.
Tools: save_login list_logins delete_login create_bot_key revoke_bot_key open_session session_fetch end_session audit_log weekly_report usage_and_upgrade
save_login | Owner only (your Pro key, never a bot key). Store one login sealed with AES-256-GCM, with a scope: allowed hosts, allowed methods, a daily session cap and session TTL. Run it from your own machine, not inside the bot. The password and TOTP secret are never returned by any tool. Free watch-only stores nothing and logs would_use_vault. params: name*, domain*, username*, password*, totp_secret, scope |
list_logins | List saved logins (name, domain, scope, sessions today; never secrets). With your owner key it also lists bot keys. A bot key only sees the logins it was granted. params: none |
delete_login | Owner only. Delete a saved login, end its open sessions and remove it from every bot key. params: name* |
create_bot_key | Owner only. Make a per-bot key (vk_...) that can only open sessions on the logins you name. Shown once; we store only its hash. Revoke any time with revoke_bot_key. params: label*, logins* |
revoke_bot_key | Owner only. Revoke a bot key right away and end every session it opened. params: bot_id* |
open_session | Sign in with a saved login without seeing it. The server fills {{username}}, {{password}} and {{totp}} into your form, posts it to url (https, inside the login's allowed hosts), keeps the cookies encrypted, and returns an opaque session id. Checked against the login's scope and daily cap; logged to the audit log. If the site shows a CAPTCHA or new-device check, the reply suggests next_step request params: name*, url*, form, as, method, prefetch |
session_fetch | Make one request inside an open session. url must be https inside the login's allowed hosts and the method must be in its allowed methods. The password, TOTP secret and codes are redacted from the reply; cookies never leave the vault. params: session*, url*, method, headers, body |
end_session | End a session now and wipe its cookies. params: session* |
audit_log | Owner only. The last uses of your vault: who (bot label), which login, which domain, what happened. Never contains secrets. params: limit |
weekly_report | Plain-English summary of the last 7 days: where your bots needed to sign in (by domain), sessions opened, blocked attempts, by bot. Read-only. Needs a key. params: none |
usage_and_upgrade | Show today's usage for your key or IP and the $9/month upgrade link. Free tier: 500 calls/day. Not metered. params: none |
Entries describe changes in tool definitions. They are not statements about a server, its quality or its author. The grade measures how the tool definitions fit model providers (token cost, schema compatibility, confusable names) as scored by the ToolFit engine at the time of the listing. JSON: append .json. Opt-out: how or hello@youraitools.co.