OpVault is an MCP server and an OAuth 2.1 provider. Claude, Cowork and Claude Code connect with one click; everything they touch is written to the trail.
$ claude mcp add opvault https://vault.opscend.net/api/public/mcp --transport httpStreamable HTTP, JSON-RPC 2.0, stateless. One endpoint. A 401 carries the RFC 9728 WWW-Authenticate header, which is what makes one-click connect appear in Cowork and claude.ai.
POST https://vault.opscend.net/api/public/mcpProtocol2025-06-18AuthAuthorization: Bearer opvault_<48 hex> · or OAuthBatchnot supported · one message per requestcurl -X POST https://vault.opscend.net/api/public/mcp \ -H "Authorization: Bearer $OPVAULT_TOKEN" -H "content-type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}' → {"result":{"protocolVersion":"2025-06-18","serverInfo":{"name":"opvault","title":"OpVault"}}}
Reads need a valid token. Writes need an owner-class token and show an approval card in chat. Every call lands on the trail under the key that made it.
record_readtitle, fields, body as markdown, cords, files, versionsrecord_write_bodyappend or replace, markdown or blocks; every write a versionfile_writetext or base64 ≤ 5 MB; new file or new versionfile_readtext content, or a one-hour link for binarycollection_recordsrows with typed properties, filter by fieldtether_search · tether_why · tether_impactreason over the graphrecord_versions · file_versions · *_restorenothing is lostlist_commands · execute_commandaudited operations with approval policiesnotify · read_auditthe inbox and the trail, by tool{"method":"tools/call","params":{"name":"file_write","arguments":{
"name":"offer-calc.py","collection":"Listings",
"content":"ask = 1_180_000\nprint(ask)","reason":"first draft"}}}
→ {"id":"fdc8…","name":"offer-calc.py","version":1,"created":true}Discovery, dynamic client registration, PKCE, a consent page in OpVault's own chrome. The issued access token is an opvault_ token, so bearer auth validates it unchanged.
/.well-known/oauth-authorization-serverResource/.well-known/oauth-protected-resourceRegisterPOST /api/public/oauth/registerAuthorizeGET /api/public/oauth/authorizeTokenPOST /api/public/oauth/token · PKCE S256Minted in Settings → Keys, revealed once, stored as a hash. Scopes read · write · run. A token only reaches its owner's rows; owner-class tools additionally require the account to be an OpVault admin.
opvault_[a-f0-9]{48}Validationproof of possession on every call · revoked tokens refusedRotationmint a new one, revoke the old; the trail keeps bothA sealed record returns its title and ai_locked: true — nothing else. Writes are refused. The attempt lands on the trail as permission_restricted. Enforced by views in the database, so a lock applied a moment ago is honoured on the next call.
{"id":"…","title":"podio-token","ai_locked":true,
"message":"This is sealed from AI. Its title is visible; its contents are not."}Every call writes an event: actor, surface, action, target, state, detail, time. Read it back with read_audit, in the app, or export CSV. Nothing is ever deleted from it.
A small daemon on your Mac. Pair it with a code; it runs Claude Code on your subscription, watches tagged folders into the file cabinet, and opens files locally. Loopback first, then a Cloudflare Tunnel that requires an OpVault origin and a paired device.
$ curl -fsSL https://vault.opscend.net/bridge/install.sh | sh $ opvault-bridge pair # shows a 6-digit code; type it in Devices
no or bad bearer · WWW-Authenticate: Bearer resource_metadata=…-32601method not foundisError: truetool refused · message says why · attempt is on the trail403 · 1010the edge blocked a bot-shaped user agent; set one