# Secrets & MCP

Poly's vault speaks the Model Context Protocol: with MCP access on, AI
agents and assistants can read — and where allowed, write — the secrets you
expose, without keys ever appearing in a prompt.

## Turning it on

Open **Connections → Secrets** and enable the Secrets MCP toggle. Vault
operations become available to the agents and assistants you run through
Poly; the panel summarizes what they can do.

## How access stays accountable

- **The activity log** — every tool call is recorded: which operation ran,
  with what parameters, and whether it succeeded. The panel's activity view
  is the readout; nothing accesses the vault off the record.
- **References, not copies** — consumers name a secret with a `vault://`
  URI instead of holding its value:

  ```
  vault://v1/u/{owner-uuid}/{name}   personal item
  vault://v1/o/{org-uuid}/{name}     org item
  ```

  Resolution happens server-side — the value is handed to the consumer for
  the task, under a lease that expires. The name is matched
  case-insensitively; the scope is always explicit.

## Outside assistants

Wiring Claude Code or Cursor directly to Poly's secrets server is still
landing — see [Claude Code](/docs/mcp-claude-code) and
[Cursor](/docs/mcp-cursor). This page carries the connection configs when
it ships.