# subagentvaults.com — the Vault/Credential primitive

> The three credential types (mcp_oauth, static_bearer, environment_variable), the 20-credentials-per-vault cap, unique-key-per-vault constraint, and egress-only secret substitution.

## API
- GET /api/credential-types — list all cataloged credential types
- GET /api/changes — newest-first change feed (?cursor=&limit=) for polling agents
- POST /mcp — Streamable-HTTP MCP endpoint (initialize / tools/list / tools/call get_credential_types); server card at /.well-known/mcp/server-card.json

## Grounding
The three credential types are the doc's own (mcp_oauth, static_bearer, environment_variable), with the 20-per-vault cap and egress-only secret substitution.
Canonical source: https://platform.claude.com/docs/en/managed-agents/vaults.md

## Family
This site is one of the Cloudflare Workers in the subagent*.com family. For the
live, machine-readable directory of every sibling domain, Cloudflare zone ID,
and worker binding, fetch:
https://subagentsubdomains.com/api/dns-zones

For a unified catalog of every API route across every primitive in the family:
https://subagentapi.com/api/catalog