# ZenVault (remote · api.zenvault.eu)

Wake-ups, webhook inboxes, TTL memory, watches and human approval for agents. Paid per call.

- Trust score: 57/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-09

## Components

- remote · `api.zenvault.eu`: 57/100 (this document), [markdown](https://verifymcp.io/servers/eu-zenvault-zenvault/api.md), [page](https://verifymcp.io/servers/eu-zenvault-zenvault/api)

## Channel facts

- Endpoint: `https://api.zenvault.eu/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-09.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 44 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2067 tokens (~46/item across 44 items; 44 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 14/100
  - Stability check failed: schema churn in the 5 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 53% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http eu-zenvault-zenvault https://api.zenvault.eu/mcp
```

### Codex

```toml
[mcp_servers.eu-zenvault-zenvault]
url = "https://api.zenvault.eu/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eu-zenvault-zenvault": {
      "type": "remote",
      "url": "https://api.zenvault.eu/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add eu-zenvault-zenvault --url https://api.zenvault.eu/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  eu-zenvault-zenvault:
    url: "https://api.zenvault.eu/mcp"
```

### Other

```json
{
  "mcpServers": {
    "eu-zenvault-zenvault": {
      "type": "http",
      "url": "https://api.zenvault.eu/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-08 (score 57, +1)

No change was recorded against any check on this day. Stability & Change Management went from 8 to 11.

### 2026-08-06 (score 56, +1)

No change was recorded against any check on this day. Stability & Change Management went from 1 to 4.

### 2026-08-05 (score 55, −1)

- [security regression] Stability: unverified → fail
- [security regression] A breaking change shipped without a version bump: still 1.0.0
- [security regression] Tool “get_trial_credit” was removed
- [security] The server rewrote its instructions, which are the text every model session reads

### 2026-08-04 (score 56)

First indexed and scored.

## MCP tools (44)

### `create_wakeup` (~66 tokens)

Schedule a webhook call at a future time (one-shot). Your agent can die; the call still happens.

Input parameters:

- `at` (string, required): ISO-8601 time to fire
- `payload` (object): JSON to include
- `url` (string, required): webhook URL to call

### `create_schedule` (~66 tokens)

Recurring webhook on a cron expression until the prepaid days run out.

Input parameters:

- `cron` (string, required): cron expression, e.g. 0 7 * * *
- `days` (number): prepaid days
- `payload` (object)
- `url` (string, required): webhook URL

### `create_deadman` (~67 tokens)

Dead-man switch: if you stop checking in, we fire your alert webhook.

Input parameters:

- `apprise_url` (string): optional human notification target
- `days` (number)
- `interval_seconds` (number): max time between check-ins
- `url` (string, required): alert webhook

### `checkin_deadman` (~34 tokens)

Check in to a dead-man switch so it does not fire.

Input parameters:

- `id` (string, required): dead-man switch id

### `delayed_delivery` (~52 tokens)

Hand over a payload now; we POST it to the target at a future moment.

Input parameters:

- `at` (string, required): ISO-8601
- `payload` (object)
- `url` (string, required): target URL

### `create_drip` (~54 tokens)

Dump up to 100 items now; we deliver them to your webhook at a fixed rate.

Input parameters:

- `items` (array, required): items to drip
- `rate_seconds` (number)
- `url` (string, required): webhook

### `notarize` (~52 tokens)

Signed proof that a hash (or your data) existed at this moment.

Input parameters:

- `data` (string): raw data to hash instead
- `note` (string)
- `sha256` (string): hex digest

### `attested_fetch` (~47 tokens)

Fetch a URL and return content plus a signed receipt binding url, status, content hash and time.

Input parameters:

- `include_content` (boolean)
- `url` (string, required): URL to fetch

### `create_inbox` (~37 tokens)

Public URL that buffers inbound webhooks until you collect them.

Input parameters:

- `days` (number): prepaid days
- `label` (string)

### `collect_messages` (~42 tokens)

Collect buffered messages from an inbox, bin, front door or form.

Input parameters:

- `all` (boolean): include already-collected
- `id` (string, required): resource id

### `create_frontdoor` (~54 tokens)

Durable front door: buffers webhooks and forwards them to your gateway with retry-until-ack.

Input parameters:

- `days` (number)
- `replay_hours` (number)
- `target` (string, required): your gateway URL

### `request_approval` (~91 tokens)

Ask a human to approve or deny an action; returns a URL for them and a signed verdict for you. Times out as denied.

Input parameters:

- `action` (string, required): what you want to do
- `apprise_url` (string): ping the human here
- `detail` (string): context for the human
- `timeout_seconds` (number)
- `webhook` (string): called with the verdict

### `check_approval` (~28 tokens)

Check whether a human approved or denied your request.

Input parameters:

- `id` (string, required): approval id

### `notify_human` (~71 tokens)

Send a message to a human on Telegram, Discord, Slack, ntfy, email and 100+ other services (apprise URL is used once, never stored).

Input parameters:

- `apprise_url` (string, required): apprise target URL
- `body` (string, required): message
- `title` (string)

### `guaranteed_delivery` (~39 tokens)

POST a payload to a URL, retried with backoff until it succeeds.

Input parameters:

- `payload` (object)
- `url` (string, required): target

### `create_vault` (~35 tokens)

Create a key-value namespace with TTL that survives your runs.

Input parameters:

- `days` (number)
- `label` (string)

### `kv_set` (~43 tokens)

Store a value in a vault (max 1 MB).

Input parameters:

- `id` (string, required): vault id
- `key` (string, required)
- `value` (string, required)

### `kv_get` (~31 tokens)

Read a value from a vault.

Input parameters:

- `id` (string, required): vault id
- `key` (string, required)

### `kv_list` (~23 tokens)

List keys in a vault.

Input parameters:

- `id` (string, required): vault id

### `save_checkpoint` (~37 tokens)

Save run state so you can resume after a crash.

Input parameters:

- `id` (string, required): checkpoint id
- `state` (string, required): serialized state

### `create_checkpoint` (~21 tokens)

Create a crash checkpoint store.

Input parameters:

- `days` (number)

### `load_checkpoint` (~22 tokens)

Load the latest saved checkpoint state.

Input parameters:

- `id` (string, required)

### `store_secret` (~41 tokens)

Store a value that self-destructs on first read; returns a one-time read URL.

Input parameters:

- `days` (number)
- `value` (string, required)

### `create_queue` (~45 tokens)

Pull-based work queue with leases; timed-out leases requeue.

Input parameters:

- `days` (number)
- `lease_seconds` (number)
- `max_attempts` (number)

### `queue_push` (~33 tokens)

Push a job onto a queue.

Input parameters:

- `body` (string, required): job payload
- `id` (string, required): queue id

### `queue_lease` (~26 tokens)

Lease the next job from a queue.

Input parameters:

- `id` (string, required): queue id

### `queue_ack` (~43 tokens)

Acknowledge (or nack) a leased job.

Input parameters:

- `action` (string)
- `id` (string, required): queue id
- `job_id` (string, required)

### `create_counter` (~27 tokens)

Create an atomic counter.

Input parameters:

- `days` (number)
- `start` (number)

### `counter_incr` (~29 tokens)

Increment a counter atomically.

Input parameters:

- `by` (number)
- `id` (string, required)

### `claim_operation` (~39 tokens)

Idempotency firewall: claim an operation id exactly once across runs.

Input parameters:

- `id` (string, required): firewall id
- `operation_id` (string, required)

### `create_idempotency` (~26 tokens)

Create an idempotency/replay firewall.

Input parameters:

- `days` (number)

### `publish_page` (~48 tokens)

Publish an HTML page at name.zenvault.eu for N days.

Input parameters:

- `days` (number)
- `html` (string, required): page HTML
- `name` (string): subdomain name

### `create_link` (~34 tokens)

Create an expiring share link with click stats.

Input parameters:

- `days` (number)
- `target` (string, required): destination URL

### `create_watch` (~191 tokens)

Watch something and fire your webhook when it changes. Types: change, keyword, regex, structured, drift, redirect, sitemap, staleness, rss, dns, port, cert, heartbeat.

Input parameters:

- `confirmations` (number): fire only after N consecutive hits
- `days` (number)
- `domain` (string): for cert watch
- `host` (string)
- `interval_seconds` (number)
- `json` (boolean)
- `keyword` (string)
- `name` (string): DNS name
- `pattern` (string): regex
- `percent` (number): drift threshold
- `port` (number)
- `record` (string): DNS record type
- `selector` (string): CSS selector or JSON path
- `type` (string, required): watch type
- `url` (string): URL to watch
- `webhook` (string, required): called on change

### `watch_status` (~26 tokens)

Check a watch: last value, checks, fires.

Input parameters:

- `id` (string, required)

### `create_escalation` (~61 tokens)

Escalation chain: webhook, then after N seconds the next step, until acknowledged.

Input parameters:

- `days` (number)
- `steps` (array, required): steps: {webhook, apprise_url, wait_seconds}
- `subject` (string)

### `get_resource` (~26 tokens)

Status of any resource you hold the management token for.

Input parameters:

- `id` (string, required)

### `extend_resource` (~30 tokens)

Extend a resource TTL by paying again.

Input parameters:

- `days` (number)
- `id` (string, required)

### `cancel_resource` (~20 tokens)

Cancel a resource early.

Input parameters:

- `id` (string, required)

### `export_resource` (~24 tokens)

Export everything under a resource before it expires.

Input parameters:

- `id` (string, required)

### `credit_balance` (~17 tokens)

Check the balance of your prepaid credit token.

### `create_subtoken` (~47 tokens)

Mint a spend-capped child token for a sub-agent.

Input parameters:

- `cap_usd` (number, required): hard spend cap
- `days` (number)
- `label` (string)

### `list_prices` (~21 tokens)

Machine-readable price list for every ZenVault service, in USD.

### `request_feature` (~51 tokens)

Tell the operator what ZenVault is missing. Free.

Input parameters:

- `what` (string, required): what you need
- `why` (string): why
- `would_pay` (string): would you pay, how much

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/eu-zenvault-zenvault/api#diagnostics

## Score history

- 2026-08-09: 57
- 2026-08-08: 57
- 2026-08-07: 56
- 2026-08-06: 56
- 2026-08-05: 55
- 2026-08-04: 56

## Links

- Remote endpoint: https://api.zenvault.eu/mcp
- Website: https://zenvault.eu/
- Changelog RSS feed: https://verifymcp.io/servers/eu-zenvault-zenvault/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/eu-zenvault-zenvault/api.json
- HTML version of this page: https://verifymcp.io/servers/eu-zenvault-zenvault/api