Where homelab credential records live. This page names vault items only and never includes secret values.
| Field | Value |
|---|---|
| Audience | Administrator |
| Vault | https://vault.pittsfamily.me |
| Agent account | [email protected] |
| Rule | Reference item names and fields only. Never paste passwords, tokens, API keys, or private keys. |
| Last verified | 2026-06-12 |
Use this page to find the right Vaultwarden item. It intentionally does not contain credential values. Retrieve values only through Vaultwarden, and only when the task is authorized.
Agents use the AI-Agent organization. The personal [email protected] vault is off-limits.
https://vault.pittsfamily.me.The agent-side CLI session is normally stored at /private/tmp/bwsession.txt. To check status without printing secrets:
BW_SESSION=$(cat /private/tmp/bwsession.txt) bw status
To list item names only:
BW_SESSION=$(cat /private/tmp/bwsession.txt) bw list items --organizationid <AI-Agent-org-id> \
| python3 -c 'import json,sys; [print(i["name"]) for i in json.load(sys.stdin)]'
Verified AI-Agent organization item names:
| Area | Vaultwarden item |
|---|---|
| Policy | Broker Policy - Agent Scope Map |
| Cloudflare | Cloudflare - Global API Token - pittsfamily.me |
| Cloudflare | Cloudflare - API Token - NPM DNS |
| Cloudflare | Cloudflare - Tunnel Token - pittsfamily.me |
| Cloudflare | Clouflare - Zero Trust & DNS Token - pittsfamily.me |
| Enphase | Enphase - Account - Homeowner |
| Home Assistant | HA Token - AI Agent Admin |
| Home Assistant | HA Token - AI Agent Read Only |
| Immich | Immich - DB Credentials - Mnemosyne Staged |
| MCP | MCP Token - Agent-HA - Local Only |
| MCP | MCP Token - Broker Admin - Break Glass |
| MCP | MCP Token - Claude Code - MacBook |
| MCP | MCP Token - Codex - MacBook |
| Mnemosyne | Mnemosyne - SMB Account - Scanner |
| Mnemosyne | Mnemosyne - Secrets Bundle - Claude SSH & TrueNAS API |
| VPN/torrent | Mullvad - WireGuard Config - vpn-torrent |
| NPM | Nginx Proxy Manager - Account - Claude |
| Pi-hole | Pi-hole - Account - Admin |
| Resend | Resend - API Key - Home Assistant Email |
| Roomba | Roomba - Device Secret - Kanga Upstairs |
| Roomba | Roomba - Device Secret - Roo Living Room |
| SSH | SSH Key - Agent Admin |
| SSH | SSH Key - Cortex - sysadmin |
| SSH | SSH Key - HAOS - root |
| SSH | SSH Key - Mnemosyne - Claude |
| SSH | SSH Key - Proxmox1 - root |
| SSH | SSH Key - Proxmox2 - root |
| TrueNAS | TrueNAS - Account - Stephanie |
| TrueNAS | TrueNAS - Account - Zahe |
| UniFi | UniFi - AI-Agent Admin Local Login - Router |
| UniFi | UniFi - API Key - Router |
| UniFi | UniFi - WiFi PSK - Pitts IoT |
| Vaultwarden | Vaultwarden - Account - Claude |
| Vaultwarden | Vaultwarden - Admin Token - Server Admin |
| Wiki.js | Wiki.js - Account + API Key - Admin |
Credential records are stored in Vaultwarden, not in MCP or local text files. MCP topics may mention item names and retrieval patterns, but never values.
Naming convention for new items:
<Service/Product> - <Credential Type> - <Purpose/Account>
Use the exact product name and a clear purpose.
When creating or rotating a secret:
Vaultwarden itself is documented in the Vaultwarden runbook. For this page, recovery means rebuilding the index from Vaultwarden item names:
BW_SESSION=$(cat /private/tmp/bwsession.txt) bw list items --organizationid <AI-Agent-org-id>
Print only item names and metadata, never secret fields.
[email protected] can access the approved collections.| Issue | Impact | Action |
|---|---|---|
| Some item names still use old hyphen style or typos | Search may be inconsistent | Rename during a dedicated cleanup, not during emergency work. |
Archive is human-only by default |
Agents should not use archived credentials | Get explicit approval for any exception. |
| Credential values must never appear in docs | Secret leak risk | Use item names only. |