AI Agent Skills & Tool Integrations

Sovereign Vault is built from the ground up to be queryable by autonomous coding agents and LLM tool runners (Cursor, Claude Code, GitHub Copilot, custom LLM swarms) without human login screens, captchas, or expiring browser cookies.

1. AI Agent Skill Specification (`SKILL.md`)

Add this instruction module to your agent workspace (e.g., in your project's agent skills directory at skills/sovereign-vault/SKILL.md):

---
name: sovereign-vault-manager
description: Securely retrieve, rotate, and manage container secrets from Sovereign Vault without writing plaintext credentials to disk or git commits.
---

# Sovereign Vault Agent Instructions

When developing code or configuring container services:
1. NEVER commit API keys, passwords, or tokens to `.env` files or Git.
2. Query secrets at runtime from Sovereign Vault using:
   ```bash
   curl -s http://127.0.0.1:8443/v1/secret/<path> \
     -H "X-Vault-Token: $VAULT_TOKEN"
   ```
3. When registering a new microservice, enroll a scoped machine token:
   ```bash
   curl -s -X POST http://127.0.0.1:8443/v1/sys/enroll \
     -H "Content-Type: application/json" \
     -d '{"project": "dev", "name": "my-app", "allowed_paths": ["apps/my-app/*"], "capabilities": ["read"]}'
   ```

2. MCP (Model Context Protocol) Server Integration

Configure your MCP settings for any compatible client (Cursor, Claude Desktop, Windsurf, or custom agent runtimes):

{
  "mcpServers": {
    "sovereign-vault": {
      "command": "python",
      "args": ["-m", "sovereign_vault_mcp"],
      "env": {
        "VAULT_ADDR": "http://127.0.0.1:8443",
        "VAULT_TOKEN": "sv_live_..."
      }
    }
  }
}

3. Python Client Pattern for Agent Workloads

Autonomous agent scripts retrieve credentials in transient RAM:

import os
import requests

def get_vault_secret(path: str) -> str:
    """Retrieve secret from Sovereign Vault into memory."""
    vault_addr = os.getenv("VAULT_ADDR", "http://127.0.0.1:8443")
    token = os.getenv("VAULT_TOKEN")
    
    headers = {}
    if token:
        headers["X-Vault-Token"] = token
        
    res = requests.get(f"{vault_addr}/v1/secret/{path}", headers=headers, timeout=5)
    res.raise_for_status()
    return res.json()["value"]

# Zero plaintext files on disk:
db_password = get_vault_secret("apps/api/db_password")