HashiCorp Vault MCP

The Vault MCP server is HashiCorp's open source bridge between the Model Context Protocol and a Vault cluster, letting an assistant inspect and manage secrets infrastructure through structured tool calls instead of shell commands. It covers the operational surface teams touch most: listing and enabling secrets engines and mounts, reading and writing key value secrets at a path, and working with the PKI engine to view roles, issuers and issued certificates. Authentication uses the same credentials the Vault CLI does, typically a token and cluster address supplied through environment variables, so every call is subject to the policies attached to that token. Nothing bypasses Vault's access control, and an agent given a narrowly scoped token can only reach the paths that token allows. That makes it reasonable to point an assistant at a development or staging cluster while production stays behind tighter policies. It is built for platform engineers, security teams and application developers who manage secrets and certificate issuance in Vault and want an agent to answer configuration questions, scaffold engine setup, or troubleshoot a mount without switching to the CLI. The server ships as a standalone binary and container image and connects over stdio or HTTP, which covers coding agents and desktop MCP clients alike.