reveal_key, add_key, and update_key now rate limit incorrect vault keys to 10 attempts per 15 minutes, per user and per source address.

These tools check the key against a stored hash, so without a limit they could be used to guess it online. The equivalent web and CLI endpoints already had this limit.

When a call is throttled, the tool tells the agent how long to wait and not to retry sooner, so a model can't keep retrying the same rejected key.

This release also derives the User-Agent sent to the ApiVault API from the package version, replacing a hardcoded 1.0.3 that had gone stale.

Learn more in the MCP tools reference.