Vault Cortex

Install

Pin version unavailable — the image reference already carries a tag

Docker
docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.55.3

Setup by client

Pick your client — the config below is generated for this server (local stdio). Copy respects the “Pin version” switch above.

{
  "mcpServers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.55.3"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>"
      }
    }
  }
}

claude mcp add --env MCP_AUTH_TOKEN=<YOUR_MCP_AUTH_TOKEN> vault-cortex -- docker run -i --rm ghcr.io/aliasunder/vault-cortex:0.55.3

{
  "mcpServers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.55.3"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>"
      }
    }
  }
}

{
  "servers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.55.3"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>"
      }
    }
  }
}

{
  "mcpServers": {
    "vault-cortex": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/aliasunder/vault-cortex:0.55.3"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "<YOUR_MCP_AUTH_TOKEN>"
      }
    }
  }
}

Environment variables

Defined in the server's official registry manifest. Required secrets are shown as <YOUR_…> placeholders in the configs above.

• MCP_AUTH_TOKEN required secret — Bearer token for MCP client authentication. Must match the Authorization header sent by clients. Generate with: openssl rand -hex 32
• PUBLIC_URL — Public URL clients use to reach this server. Used as the OAuth issuer URL in discovery metadata. Override when exposing the server outside localhost or on a non-default port.
• EMBEDDING_ENABLED — Enable or disable the embedding pipeline. When false, no ONNX model is downloaded, no vector tables are created, and search uses FTS5 only.
• RERANK_MODE — Cross-encoder reranking mode: blended (position-aware score blending after RRF fusion) or none (skip reranking). Only takes effect when EMBEDDING_ENABLED is true.
• WINDOWS_MODE — Windows bind-mount mode: enables filesystem polling for the file watcher and rename-based moves across the Docker Desktop/WSL2 bridge. Set to true when the vault lives on a Windows drive.
• MEMORY_ENABLED — Enable or disable the structured memory layer. When false, memory tools are hidden, bootstrap is skipped, and server metadata omits memory references.
• FILE_TOOLS_ENABLED — Enable or disable file tools (vault_read_file, vault_list_files). When false, file tools are hidden and server metadata omits file tool references.
• READONLY_MODE — Run the server read-only: every vault-writing tool is hidden, the memory folder is not auto-created, and server metadata omits write references.

GitHub

About this server