How to Use the CyberArk Privilege Cloud MCP in Claude

Manage PAM infrastructure directly from Claude Desktop. Audit safes, rotate credentials, and kill rogue sessions without opening a new tab.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect CyberArk Privilege Cloud MCP to Claude Desktop

Create your Vinkius account to connect CyberArk Privilege Cloud to Claude Desktop and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup CyberArk Privilege Cloud with Claude Desktop

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Audit Vault Access from Claude Desktop

Security teams waste hours jumping between dashboards to map out logical access architectures. This MCP Server lets you ask Claude to pull exactly who has access to what right now. Running `list_safes` gives you the core physical and logical containers holding your credentials. Following that up with `list_groups` maps out the RBAC permissions tied to those containers. If an auditor asks for proof of separation of duties, your agent pulls the live data in seconds instead of you clicking through ten web views.

Provision and Deprovision Accounts

Onboarding new critical infrastructure means setting up credentials fast. You tell your local AI to run `add_account`, mapping the exact Platform ID like UnixSSH or WinDesktopLocal so the system knows how to handle future rotations. The MCP Server passes the exact payload required. Tearing down old systems requires just as much precision. Firing `delete_account` removes the vaulted credential entirely, which stops the CPM from throwing failed rotation errors against a dead server.

Incident Response and Password Retrieval

When a SOC analyst flags weird behavior on a critical tier-0 server, speed matters. You can immediately fire `terminate_session` to forcefully kill that active PSM or PSMP connection mid-stride. If someone actually needs emergency access, `retrieve_password` grabs the clear-text credential. Every checkout triggers a mandatory justification reason and hits your SIEM alerts, keeping the whole process strictly audited while still being fast.

Setup guide

Set up CyberArk Privilege Cloud MCP in Claude Web or Desktop

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.
2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.
3

Start a conversation

Open a new chat. The CyberArk Privilege Cloud MCP tools are available immediately — no restart needed.

Endpoint URL

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

No configuration file needed — paste the URL directly in the Claude web interface.

Available on Free (1 connector), Pro, Max, Team, and Enterprise plans.

Prerequisites

Claude Desktop installed (macOS or Windows)
Active Vinkius subscription with a valid endpoint token

1

Open Claude Desktop Settings

Click the menu icon at the top-left corner, go to Settings → Developer → Edit Config. This opens claude_desktop_config.json in your default text editor.
2

Paste the CyberArk Privilege Cloud MCP configuration

Copy the JSON snippet on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Restart Claude Desktop

Close and reopen the application. Claude needs a full restart to load new MCPs — refreshing a conversation is not enough.
4

Verify the connection

Open a new conversation. Click the 🔌 icon at the bottom of the message input. You should see tools listed under cyberark-privilege-cloud-mcp.

json

{
  "mcpServers": {
    "cyberark-privilege-cloud-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by CyberArk. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect CyberArk Privilege Cloud now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about CyberArk Privilege Cloud MCP in Claude Desktop

Add the remote MCP Server URL directly in the browser via Settings then Integrations. If you prefer the local app, edit your claude_desktop_config.json file and drop the server command under the mcpServers key. Both paths require your Vinkius endpoint token for authentication.

Yes. Your agent calls the provisioning endpoints to inject new credentials into your Vault Safes. You just need to specify the correct Platform ID so the backend handles rotation correctly.

Yes it will. Every checkout requires a justification string and logs directly to your SIEM. Exclusive access platforms will also lock that credential until it checks back in.

Tell your AI client to kill it immediately. The termination tool drops the active Privileged Session Manager connection instantly, cutting off the user before they can do damage.

Clear-text passwords and vault metadata pass through a V8 Isolate Sandbox that destroys itself after the request finishes. We never store your tier-0 credentials or safe allocations, and the entire transaction happens inside a zero-trust ephemeral environment.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript