Vault MCP Server
About
An MCP server for interacting with the HashiCorp Vault secrets management tool.
Details
- Author
- mschuchard
- Downloads
- 317
- Categories
- Cloud Service, Security, Infrastructure, Developer Tools
Jump to
- 5 resources: ACL policies, audit devices, auth engines, secret engines, Raft cluster config.
- 138 tools covering system and secrets backends.
- 4 prompts for ACL policy generation and Vault diagnostics.
- Supports token, userpass, and approle authentication methods.
- Configurable cache TTL for read/list operations.
- Container image available on Dockerhub.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Vault MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Configure the server as a Docker container in desktop MCP clients like Claude or VSCode. Set environment variables for Vault connection (e.g., VAULT_URL, VAULT_TOKEN, VAULT_AUTH_METHOD) and pass them to the container. Example configuration files are provided for Claude and VSCode.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"vault mcp server": {
"vault": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"VAULT_URL",
"-e",
"VAULT_TOKEN",
"matthewschuchard/vault-mcp-server"
],
"env": {
"VAULT_URL": "<VAULT SERVER CLUSTER URL>",
"VAULT_TOKEN": "<VAULT AUTHENTICATION TOKEN>"
}
}
}
}
}McpServers
{
"vault": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"VAULT_URL",
"-e",
"VAULT_TOKEN",
"matthewschuchard/vault-mcp-server"
],
"env": {
"VAULT_URL": "<VAULT SERVER CLUSTER URL>",
"VAULT_TOKEN": "<VAULT AUTHENTICATION TOKEN>"
}
}
}There is now an official Vault MCP Server from Hashicorp. Therefore, the alternative third-party Vault MCP Server will continue to exist and be updated with features and fixes, but no attempt will be made to compete with the official product. The third-party Vault MCP Server can be executed locally instead of only remotely (although in many situations remote is preferable), and will continue to be available as a container image.
Due to this policy enacted because of the official product release, there will be no formal release process, versioning, or changelog. This product is also not recommended for enterprise production usage.
The MCP Server container image is hosted atDockerhub, and it represents the code hosted here atHEAD.
These can hopefully be extrapolated and modified to fit other clients if you want to play with this server for whatever reason.
{ "mcpServers": { "vault": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "ENV_VAR", "-e", "ENV_VAR_TWO", "matthewschuchard/vault-mcp-server" ], "env": { "ENV_VAR": "<ENV VAR VALUE>", "ENV_VAR_TWO": "<ENV VAR TWO VALUE>", } } } }
TheMCP: Add Server --> Docker Imagecommand can also streamline this configuration. The values below can be entered into the input prompts, and then themcp.jsonfile is automically opened within a pane afterward for further updates if necessary.
{ "servers": { "vault": { "type": "stdio", "command": "docker", "args": [ "run", "-i", "--rm", "-e", "ENV_VAR", "-e", "ENV_VAR_TWO", "matthewschuchard/vault-mcp-server" ], "env": { "ENV_VAR": "<ENV VAR VALUE>", "ENV_VAR_TWO": "<ENV VAR TWO VALUE>", } } } }
These environment variables can all be defined and passed to the Vault MCP Server utilizing the pattern shown above forENV_VAR.
Establishes the cache time for all read and list operations before new value(s) are retrieved instead of using the cached value.
Selects the Vault authentication method from amongapprole,jwt(beta),token, anduserpass.
Path at which the utilized Vault authentication method is mounted.
JSON Web Token for entity with thejwtauthentication method.
Establishes the Vault namespace (enterprise only).
Password for user with theuserpassauthentication method.
Role for entity with thejwtauthentication method.
Role ID for entity with theapproleauthentication method.
Secret ID for entity with theapproleauthentication method.
Token for entity with thetokenauthentication method.
Username for user with theuserpassauthentication method.
- Current Enabled ACL Policies
- Current Enabled Audit Devices
- Current Enabled Authentication Engines
- Current Enabled Secret Engines
- Current Raft Cluster Configuration
- System Backend
- ACL Policies
- Audit Devices
- Authentication Engines
- Raft (Clustering and Storage Snapshots)
- Secrets Engines
- Database (Beta)
- Identity/Alias
- KV Version 2
- PKI
- Transit
- mcp.vault.example-acl-policy: This displays an example Vault ACL Policy in JSON string format. The displayed policy can be modified and entered as-is to the LLM (verified with agentic Claude), and it will understand that you want to create an ACL Policy through the Vault MCP Server with your modified content (with an auto-generated name). However, it is probably more prudent to use it as an input to the tool instead.
- mcp.vault.generate-acl-policy: This displays a pseudo-example Vault ACL Policy in JSON string format similar to the above prompt. The primary difference is that this prompt accepts apathsargument inlist[str]type format, and the returned policy will contain the input paths. However, thecapabilitieswill still be boilerplate, and need to be modified for your usage.
- mcp.vault.generate-smart-acl-policy: This is an interactive workflow with an agentic LLM to create and optimize a Vault ACL policy based on user requirements and prompts. It will also return the policy in JSON string format.
- mcp.vault.diagnose-vault-state: This is a diagnostic scanner to target your Vault server cluster with the resources available in this MCP server and report on any perceived deficiencies with respect to the server configuration.
Manage Akamai's edge platform, including properties, DNS, certificates, security, and performance optimization, using AI assistants.
Provides a unified interface to AWS services for security investigations and incident response.
An MCP server that enables AI assistants to interact with AWS security services.
DevOps MCP — Secure MCP Server for Linux Server Automation
A three-tier access control MCP server that allows AI assistants (Claude Code, Cursor, Windsurf) to safely scan, plan, and operate Linux servers via SSH without full write access. Includes an out-of-band human consent token gate, automated port-conflict scanning, and a completely read-only default safe mode to eliminate accidental destructive commands on production environments.
An MCP server for Alibaba Cloud's Edge Security Acceleration (ESA) service.
Securely manage secrets and policies in HashiCorp Vault through an MCP interface.
Interact with the Illumio Policy Compute Engine (PCE) to manage workloads, labels, and analyze traffic flows.
Interact with Jamf Pro for Apple device management tasks.
Interact with JupiterOne's data and tools through an MCP server, enabling AI assistants to access your JupiterOne account.
A RESTful API to programmatically interact with the Opal Security platform.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
