Spec Driven Development
by formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Runs on your computer★ 440MITUpdated 14 months ago
Install
vaultgate
Overview
Description from the maker (original English)
Self-hosted remote MCP server for Bitwarden and Vaultwarden with OAuth 2.1; agents hold tokens only
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs in the cloud
- Transport: Streamable HTTP
- Category: Other
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on the maker’s server: what you ask it goes through their server.
- The registry lists no key to fill in.
You need
- Runs in the cloudNothing to install; it connects over the internet
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Works in Claude on the web, desktop and mobile:
- Open Settings → Connectors
- Press Add custom connector
- Paste the address below and press Add
- If it asks you to sign in, sign in with the maker
https://{vaultgate_host}/mcpThe address contains {…} parts that only you know (such as your account), so copy it and fill them in.
Run this in your terminal
claude mcp add --transport http vaultgate 'https://{vaultgate_host}/mcp'The address contains {…} parts that only you know (such as your account), so copy it and fill them in.
Or copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"vaultgate": {
"url": "https://{vaultgate_host}/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
The address contains {…} parts that only you know (such as your account), so copy it and fill them in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"vaultgate": {
"type": "http",
"url": "https://{vaultgate_host}/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
ChatGPT connects only to servers on the internet:
- Open ChatGPT on the web → Settings → Connectors (Apps)
- Press Create or Add (some plans need Developer mode under Advanced first)
- Paste the address below, give it a name and save
- If it asks you to sign in, sign in with the maker
https://{vaultgate_host}/mcpThe address contains {…} parts that only you know (such as your account), so copy it and fill them in.
Menu names can differ slightly by plan and over time.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
We have not read this server’s tool list yet; we check endpoints in rotation.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account adamrowles1996, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
The address needs your own account values, so we cannot check it for you
- – Not applicable
Sign-in with OAuth
The address needs your own account values, so we cannot check it for you
- … Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint
Compared with others in Otheri
- More stars than 0% of the other 32706 servers in this category
- Published to the registry more recently than 48% of the other 32706 servers in this category
- Basic checks equal to or better than 100% of the other 32706 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is vaultgate safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.1.0-rc.10) reached the registry 44 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.
What can I use instead?
In the same category: Spec Driven Development, Remote Desktop Commander, Kanal Varna — drains, leaks & plumbing (Varna, BG)
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Remote Desktop Commander
by desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Runs in the cloud★ 211Updated 2 days ago
Install
Kanal Varna — drains, leaks & plumbing (Varna, BG)
by kanalvarna.com
Drain unblocking, leak detection & plumbing in Varna, Bulgaria: services, prices, areas, contact
Runs in the cloudUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
vaultgate
A self-hosted, remote MCP server that lets hosted AI agents such as Claude, Claude Cowork, Claude Code and Codex use your credentials without ever seeing them. The credentials stay in your Bitwarden (or Vaultwarden) vault. vaultgate uses them on the agent's behalf against systems you define (an HTTP API, Microsoft Graph, a SQL Server or PostgreSQL database, an SSH or WinRM host, a GitHub repository searched with Semble) under your policy, and hands back only the result. It is its own OAuth 2.1 authorization server, so the agent holds a short-lived, scoped, revocable token and nothing else.
Status: release candidate. Milestones M1 to M7 are merged: configuration, SQLite store,
operator identity with TOTP, the OAuth 2.1 authorization server, the MCP tool surface, the
managed
bw servebackend, the audit trail, packaging and the Azure template. M8 (hardening and
compatibility evidence) is in progress. The actions layer, opt-in and off by default, has landed
through M14: M9 the engine, the operator pages and the
httpconnector, M10 the Microsoft Graph
credential adapter, M11
sql, M12ssh, M13winrm, and M14 the policy-form validation
messages, the call-history and writes views and grant management from the connected-clients
list. M16 adds the
codeconnector: Semble code search over private GitHub repositories, with
its sidecar (guide). An
httpdestination may pin its certificate
or trust a private certificate authority, and the
oauth2credential mode obtains tokens from
any OAuth 2.0 token endpoint (guide). vaultgate's own per-call
write confirmation is withdrawn: approval belongs to the agent's client. The opt-in credential
relay serves
bw serve's read API to programs on tagged Tailscale nodes
(guide).
browseris M15; seedocs/PLAN.md.
Why
A credential an agent can read ends up in the transcript. Once an agent reveals a password in order to use it, the value sits in the model's context, in the chat transcript, in the client's logs and on whatever command line the agent builds, and revoking the agent does not take it back. vaultgate is built so that the agent never needs the value:
- Use, don't read. With the actions layer enabled (guide, spec 13 and 13a, ADR 0007), an agent names a target you defined and describes an operation: an HTTP request, a SQL query or statement, a command on an SSH or WinRM host, a Semble search of a GitHub repository. vaultgate fetches the credential from the vault, connects to the pinned destination, runs the operation inside your policy, scrubs every injected value from the result and returns what is left. An agent never supplies a host, a URL base, a database name or a credential; its arguments change what runs, never where or as whom.
- Writes are opt-in twice, and approved where you work. A write needs its own scope at consent and a target policy that allows it. Approving each call is the agent's client's job — Claude Code, for one, asks before it runs a tool its permissions do not allow — and the console lists every call that changed something.
- One audited door for the rare value that must be read. The vault tools return metadata. A single tool returns a secret value, one field of one item per call, behind its own scope, with every call audited.
- Nothing runs on the vaultgate host. No tool runs whatever an agent sends wherever it likes:
ssh_runandwinrm_runrun one command on one configured host under your allowlist (a target that accepts any command needs both its own flag and the deployment's consent), and every operation executes at its target. - The agent holds a token and nothing else. The master password and API key live only in the vaultgate process on your host, encrypted under your secret key once you connect the vault on the console's Vault page.
- Standards as written. OAuth 2.1, PKCE, RFC 9728 / 8414 / 8707 / 7591 / 7009 / 9207 and Client ID Metadata Documents, per the MCP authorization specification (2026-07-28).
- Any Bitwarden. bitwarden.com, bitwarden.eu, self-hosted Bitwarden and Vaultwarden.
- Boring to operate. One process, one SQLite file, structured logs, health probes, an audit trail.
docker compose upis a complete installation.
Compared with other Bitwarden MCP servers
Hosted agents reach MCP servers over HTTPS and cannot run a process next to your vault, and the other Bitwarden MCP servers are built for exactly that local process:
| Server | Where it runs | Who holds the master password / API key | Client authorization | Consent and scopes | Revocation | Audit trail | Using a credential without seeing it |
|---|---|---|---|---|---|---|---|
Official bitwarden/mcp-server | Local, stdio; its README says it must never be hosted publicly | Your machine: the bw CLI session (BW_SESSION) in the client's configuration, or an OS password dialog | None; whoever launches the process | None; every tool is available to the launching client | Lock the vault or end the bw session | Not described | Not described |
| warden-mcp, remote mode | A long-running HTTP service you host | The client, which sends them as X-BW-Password, X-BW-ClientId and X-BW-ClientSecret headers on every call | None built in ("no built-in authentication layer in v1") | None; READONLY and NOREVEAL switches apply to every client alike | Rotate the Bitwarden credentials | Not described | Not described |
| Typical community servers, e.g. vaultwarden-mcp, bitwarden-mcp-server | Local stdio, or a plain HTTP port | The server process, from environment variables holding the e-mail address and master password | None | None | Rotate the Bitwarden credentials | Not described | Not described |
| vaultgate | Your host, reachable over HTTPS by hosted agents | The vaultgate process only; the agent holds an opaque token | Built-in OAuth 2.1 authorization server: operator login with TOTP, PKCE, RFC 9728 / 8414 / 8707 / 7591 / 7009 / 9207, Client ID Metadata Documents | Per-client consent page; vault:read, vault:reveal, vault:generate, vault:write (off by default); actions:* scopes for each enabled connector | Per client or per token from the console's Agents page; refresh tokens rotate and a replay revokes the family | Every tool call, login, consent, token issue, refresh and revocation, exportable | Typed actions at targets you define: http (with Microsoft Graph), sql, ssh, winrm, code (Semble) |
"Not described" means the project's README does not document one. Dated verification notes with links, and when the official stdio server is the better choice: docs/comparison.md.
Quick start
The current version is 0.1.0-rc.28 (package.json; releases are tagged on GitHub). On a VM with Docker Engine, the Compose plugin, a DNS name pointing at it and ports 80 and 443 reachable from the internet:
git clone https://github.com/adamrowles1996/vaultgate.gitcd vaultgate cp .env.example .env
Set VAULTGATE_DOMAIN, VAULTGATE_PUBLIC_URL and VAULTGATE_VERSION in .env, then:
mkdir -p secretshead -c 32 /dev/urandom | base64 > secrets/vaultgate_secret_key touch secrets/bw_password secrets/bw_client_secret chmod 0
Only the beginning is shown; read the rest in the repo