# HashiCorp Vault MCP for AI Agents AI Agent Connect > HashiCorp Vault MCP lets you manage secrets, generate dynamic credentials, and handle encryption keys through your AI agent. It connects your Vault instance to your agent so you can fetch production keys, rotate database passwords, and manage ACL policies using natural language. It's built for teams who need to automate infrastructure security without manually jumping into the Vault UI or CLI. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/ai-agent-connect - **Tags:** secrets-management, encryption, key-management, identity-access, dynamic-credentials, security ## Description The HashiCorp Vault MCP connects your existing secrets management infrastructure to your AI agent so you can handle security operations through natural language. Usually, managing production keys involves a messy dance between developers and security teams. You're constantly switching between your IDE, a web browser for the management UI, and a terminal to run CLI commands. You copy a key, paste it into a config, and then spend the rest of the day worrying about whether that key is still valid or if it's been rotated. This friction-filled process often leads to human error or, worse, hardcoded credentials left in plain sight. This connector changes that by letting your AI agent handle the heavy lifting of secrets management directly. Instead of hunting for keys, you just tell your agent what you need, and it pulls the correct value or generates a fresh, short-lived token on the fly. You can manage everything from KV secrets to transit encryption without ever seeing the raw keys. Whether you're spinning up a new database or need to rotate a production API key, your agent handles the interaction with the backend for you. It's part of the Vinkius catalog, making it easy to plug into your existing setup so you can focus on shipping code rather than managing access. You get a way to keep your infrastructure locked down while moving at the speed of conversation. It's about removing the middleman between your intent and the secure data you need to get the job done. ## Tools ### approle_login Log in to Vault using AppRole authentication. This makes it easy to manage machine identities. ### create_aws_role Generate a new role for AWS resources. This helps automate permissions for your cloud infrastructure. ### generate_database_creds Create dynamic, short-lived credentials for your database. This lets your agent get fresh logins for every task. ### read_kv_metadata Read the metadata for a specific KV v2 secret. Use this to see when a secret was last updated. ### read_kv_secret Retrieve a secret from a KV v2 engine path. This lets your agent grab the actual value you need. ### configure_aws_root Set up your AWS root credentials in the system. Use this for initial cloud environment configuration. ### configure_kubernetes_auth Set up authentication for your Kubernetes cluster. This connects your container orchestration to your secrets. ### github_login Log in using a personal access token from GitHub. This lets your agent authenticate using your existing GitHub account. ### issue_pki_cert Issue a new certificate from your PKI engine. This automates the creation of SSL or other certificates. ### kubernetes_login Log in using your Kubernetes authentication credentials. This allows your agent to act on behalf of a K8s service. ### list_audit_devices View all currently enabled audit devices. Use this to see what actions are being logged. ### list_auth_methods See a list of all active authentication methods. This helps you see how users can log in. ### list_kv_secrets List all secrets stored in a specific KV v2 path. Use this to see what keys are available in a folder. ### configure_database Establish a connection for a specific database. This helps your agent interact with your data layer. ### create_acl_policy Define or update a new ACL policy for access control. Use this to set specific permissions for users or machines. ### create_approle_role Create or update a specific AppRole role. This is the first step in setting up machine-to-machine identities. ### create_database_role Create a specific role for database access. Use this to define what different users can do in your DB. ### create_pki_role Set up a new PKI role for certificate management. This is useful for managing internal certificates. ### create_token Generate a new Vault token for session management. Use this to create temporary access for your agent. ### create_transit_key Create a new key for the transit encryption engine. This is the foundation for encrypting data without exposing keys. ### create_userpass_user Create a new user account using username and password. Use this for standard human user authentication. ### decrypt_transit Decrypt sensitive data using the transit engine. This allows your agent to read encrypted values on the fly. ### delete_kv_secret Remove the latest version of a KV v2 secret. Use this to clean up old or compromised secrets. ### enable_audit_device Turn on an audit device to track system actions. This helps you keep a record of every interaction. ### enable_auth_method Activate a new authentication method in the system. Use this to add things like GitHub or OIDC login. ### enable_engine Turn on a new secrets engine for your instance. This allows you to add new capabilities like AWS or Database support. ### encrypt_transit Encrypt data using the transit engine for secure storage. This keeps your data safe even if the storage is compromised. ### generate_approle_secret_id Create a new Secret ID for an existing AppRole. This is needed to authenticate your machines to Vault. ### generate_aws_creds Create dynamic, short-lived credentials for AWS. This eliminates the need for long-lived access keys. ### generate_pki_root Generate a new root certificate for your PKI setup. Use this to establish your own internal certificate authority. ### get_init_status Check if your Vault cluster has been initialized. Use this to verify your system is ready for use. ### get_openapi_spec Generate an OpenAPI V3 document for your mounted backends. This helps you understand what your secrets engines can do. ### get_system_health Check the current health status of your Vault cluster. Use this to monitor your infrastructure uptime. ### initialize_vault Perform the initial setup for a new Vault cluster. Use this to get your security environment up and running. ### list_mounts View all secrets engines currently mounted. This shows you all the different types of secrets you can manage. ### list_token_accessors List all token accessors that require sudo. Use this to audit high-privilege sessions. ### lookup_lease Find details for a specific lease by its ID. This helps you track the remaining life of a dynamic credential. ### lookup_self_token Get details about the token currently being used. Use this to check your own permissions and expiration. ### map_github_team Link a GitHub team to specific Vault policies. This automates permissions for your developers based on their team. ### renew_lease Extend the duration of an existing lease. Use this to keep a dynamic credential active for longer. ### renew_self_token Extend the life of your current Vault token. Use this to prevent your session from expiring. ### revoke_lease Cancel an existing lease immediately. Use this to kill a credential if it's no longer needed. ### revoke_pki_cert Revoke a previously issued PKI certificate. Use this to invalidate a compromised certificate. ### revoke_self_token Cancel the current Vault token session. Use this to log out or kill a session instantly. ### rotate_transit_key Rotate a key within the transit engine. This refreshes your encryption keys without changing the data. ### seal_vault Lock the Vault to protect its contents. Use this to put the system into a secure, inaccessible state. ### unseal_vault Unlock the Vault using a key share. Use this to bring the system back online after a restart. ### userpass_login Log in using standard username and password credentials. Use this for simple human authentication. ### write_kv_secret Create or update a secret in a KV v2 engine. Use this to store new keys or update existing ones. ### list_acl_policies List all existing ACL policies in the system. Use this to audit who has access to what. ## Prompt Examples **Prompt:** ``` Can you check if my Vault is healthy and tell me the current version? ``` **Response:** ``` I've checked the system for you. The Vault cluster is currently healthy and initialized. It's running version 1.15.2, and all systems are reporting a 200 OK status. ``` **Prompt:** ``` I need a temporary password for the production Postgres database. ``` **Response:** ``` I've generated a dynamic credential for the production database for you. Here are the details: - **Username**: `db_user_temp_492` - **Password**: `[Redacted - Please copy from your secure terminal]` - **TTL**: 1 hour Let me know if you need anything else! ``` **Prompt:** ``` Show me the secrets we have stored in the production/api path. ``` **Response:** ``` I've listed the secrets in `production/api`: | Secret Name | Version | Last Updated | | :--- | :--- | :--- | | `STRIPE_KEY` | 4 | 2024-05-20 | | `AWS_SECRET_ACCESS_KEY` | 3 | 2024-05-18 | Would you like me to read the value for any of these? ``` ## Capabilities ### Fetch KV secrets Get specific values from your secure mounts instantly. ### Generate dynamic credentials Create temporary access for AWS, databases, and PKI. ### Manage session tokens Create, renew, and revoke tokens to control access. ### Perform transit encryption Encrypt and decrypt data without exposing your keys. ### Audit system health Check the status of your Vault cluster and mounts. ### Update ACL policies Modify permissions and access controls through natural language. ## Use Cases ### Emergency Credential Rotation A security lead notices a leak and asks the agent to rotate_transit_key and revoke_self_token immediately to stop the breach. ### Dynamic Cloud Access A developer needs to run a one-off script and asks the agent to generate_aws_creds for a specific region. ### Automated PKI Issuance An admin asks the agent to issue_pki_cert for a new microservice, handling the complex certificate logic automatically. ### Database Onboarding A new team needs access and asks the agent to configure_database and create_database_role for their new project. ## Benefits - Automate secret rotation: Use rotate_transit_key and renew_lease to keep your keys fresh without manual intervention. - Simplify cloud access: Use generate_aws_creds to get short-lived credentials for AWS instead of managing long-lived keys. - Streamline DB management: Use generate_database_creds and configure_database to handle database access dynamically. - Secure data transit: Use encrypt_transit and decrypt_transit to protect sensitive info without exposing the underlying keys. - Faster onboarding: Use create_approle_role and generate_approle_secret_id to set up machine identities in seconds. - Easier auditing: Use list_audit_devices and get_system_health to monitor your security posture through simple conversation. ## How It Works The bottom line is you get a conversational interface for your entire secrets management infrastructure. 1. Subscribe to the HashiCorp Vault MCP on Vinkius. 2. Provide your Vault address and authentication token in your AI client. 3. Ask your agent to fetch secrets, rotate keys, or check system health. ## Frequently Asked Questions **What is the HashiCorp Vault MCP used for?** It lets your AI agent interact directly with your Vault instance. You can use it to fetch secrets, manage tokens, and generate dynamic credentials for things like AWS or databases without leaving your chat interface. **Can I use the HashiCorp Vault MCP to manage my production secrets?** Yes, that's exactly what it's built for. You can ask your agent to read, write, or list KV secrets, making it much easier to manage production environment variables securely. **Does the HashiCorp Vault MCP support AWS dynamic credentials?** Yes, it can generate short-lived AWS credentials on demand. This helps you avoid using long-lived IAM keys by letting your agent create them only when you need them. **How does the HashiCorp Vault MCP handle encryption?** It connects to Vault's transit engine, allowing your agent to encrypt and decrypt data. This means you can protect sensitive information without ever having to handle the encryption keys directly. **Can I use the HashiCorp Vault MCP to manage PKI certificates?** Absolutely. Your agent can issue new certificates, generate PKI roots, and revoke certificates through natural language commands, simplifying your certificate lifecycle. **Is the HashiCorp Vault MCP safe for my security team?** It's designed with security in mind. It allows for precise control over ACL policies and token management, ensuring that your agent only performs actions that your Vault configuration allows. **Can I check the remaining TTL and policies of my current session token?** Yes. Use the `lookup_self_token` tool. It returns the creation time, TTL, associated policies, and metadata for the token currently in use. **How do I retrieve a specific secret from a KV version 2 engine?** Use the `read_kv_secret` tool by providing the path to the secret. The agent will fetch the data and present the key-value pairs securely. **Is it possible to generate temporary database credentials through the agent?** Yes. If the database engine is configured, use `generate_database_creds` with the specific role name to receive a temporary username and password.