HashiCorp Vault MCP Server with 50 Tools for Claude, Cursor, and AI Agents

Name: HashiCorp Vault
Price: 29 USD
Availability: InStock
Rating: 4.9 (1 reviews)
Author: Vinkius

GDPR Free for Subscribers

Securely manage secrets, tokens, and encryption keys via HashiCorp Vault — read KV secrets, generate dynamic credentials, and monitor system health. Vinkius routes your AI agents directly to HashiCorp Vault through a governed connection. 50 tools ready to use with Claude, ChatGPT, Cursor, or any AI agent — no hosting, no setup, connect in 30 seconds.

Built for AI Agents by Vinkius

Ask AI about this server

Open in ChatGPT Open in Claude Open in Perplexity

Compatible with every major AI agent and IDE

Claude

ChatGPT

Cursor

Gemini

Windsurf

VS Code

JetBrains

Vercel

+ other MCP clients

AI Agent→Vinkius

High Security·Kill Switch·Plug and Play

Fully ManagedVinkius Servers

60%Token savings

High SecurityEnterprise-grade

IAMAccess control

EU AI ActCompliant

DLPData protection

V8 IsolateSandboxed

Ed25519Audit chain

<40msKill switch

Stream every event to Splunk, Datadog, or your own webhook in real-time

* Every MCP server runs on Vinkius-managed infrastructure inside AWS - a purpose-built runtime with per-request V8 isolates, Ed25519 signed audit chains, and sub-40ms cold starts optimized for native MCP execution. See our infrastructure

What is the HashiCorp Vault MCP Server?

The HashiCorp Vault MCP Server routes AI agents like Claude, ChatGPT, and Cursor directly to HashiCorp Vault via 50 tools. Securely manage secrets, tokens, and encryption keys via HashiCorp Vault — read KV secrets, generate dynamic credentials, and monitor system health. Powered by Vinkius — your credentials stay on your side of the connection, every request is auditable. Connect in under 2 minutes.

Built-in capabilities (50)

approle_loginconfigure_aws_rootconfigure_databaseconfigure_kubernetes_authcreate_acl_policycreate_approle_rolecreate_aws_rolecreate_database_rolecreate_pki_rolecreate_tokencreate_transit_keycreate_userpass_userdecrypt_transitdelete_kv_secretenable_audit_deviceenable_auth_methodenable_engineencrypt_transitgenerate_approle_secret_idgenerate_aws_credsgenerate_database_credsgenerate_pki_rootget_init_statusget_openapi_specget_system_healthgithub_logininitialize_vaultissue_pki_certkubernetes_loginlist_acl_policieslist_audit_deviceslist_auth_methodslist_kv_secretslist_mountslist_token_accessorslookup_leaselookup_self_tokenmap_github_teamread_kv_metadataread_kv_secretrenew_leaserenew_self_tokenrevoke_leaserevoke_pki_certrevoke_self_tokenrotate_transit_keyseal_vaultunseal_vaultuserpass_loginwrite_kv_secret

Tools for your AI Agents to operate HashiCorp Vault

Ask your AI agent "Check the health and initialization status of my Vault server." and get the answer without opening a single dashboard. With 50 tools connected to real HashiCorp Vault data, your agents reason over live information, cross-reference it with other MCP servers, and deliver insights you would spend hours assembling manually.

Works with Claude, ChatGPT, Cursor, and any MCP-compatible client. Powered by Vinkius — your credentials never touch the AI model, every request is auditable. Connect in under two minutes.

Why teams choose Vinkius

One subscription gives you the infrastructure to connect your AI agents to thousands of MCP servers — and deploy your own to the Vinkius Edge. Your credentials stay yours. Your data flows directly between your agent and the API. DLP blocks sensitive information from ever reaching the model, kill switch for instant shutdown, and up to 60% token savings. Enterprise-grade routing and governance, zero maintenance.

Build your own MCP Server with our secure development framework →

The HashiCorp Vault App Connector works with every AI agent you already use

…and any MCP-compatible client

Use all 50 HashiCorp Vault tools with your AI agents right now

Vinkius routes your AI agents to HashiCorp Vault through a governed proxy. Beyond a simple connection, you get full visibility into every action your agents perform, with enterprise-grade security and up to 60% savings on AI costs.

Explore Tools Hub

approle

Approle login on HashiCorp Vault

configure

Configure aws root on HashiCorp Vault

Configure AWS root credentials

configure

Configure database on HashiCorp Vault

Configure a database connection

configure

Configure kubernetes auth on HashiCorp Vault

Configure Kubernetes authentication

create

Create acl policy on HashiCorp Vault

Create or update an ACL policy

create

Create approle role on HashiCorp Vault

Create or update an AppRole role

create

Create aws role on HashiCorp Vault

Create an AWS role

create

Create database role on HashiCorp Vault

Create a database role

create

Create pki role on HashiCorp Vault

Create a PKI role

create

Create token on HashiCorp Vault

Create a new Vault token

create

Create transit key on HashiCorp Vault

Create a new Transit key

create

Create userpass user on HashiCorp Vault

Create a new Userpass user

decrypt

Decrypt transit on HashiCorp Vault

Decrypt data using Transit engine

delete

Delete kv secret on HashiCorp Vault

Delete the latest version of a KV v2 secret

enable

Enable audit device on HashiCorp Vault

Enable an audit device

enable

Enable auth method on HashiCorp Vault

Enable a new auth method

enable

Enable engine on HashiCorp Vault

Enable a new secrets engine

encrypt

Encrypt transit on HashiCorp Vault

Encrypt data using Transit engine

generate

Generate approle secret id on HashiCorp Vault

Generate a new Secret ID for an AppRole

generate

Generate aws creds on HashiCorp Vault

Generate dynamic AWS credentials

generate

Generate database creds on HashiCorp Vault

Generate dynamic database credentials

generate

Generate pki root on HashiCorp Vault

Generate a new PKI root certificate

get

Get init status on HashiCorp Vault

Check Vault initialization status

get

Get openapi spec on HashiCorp Vault

Generate OpenAPI V3 document of mounted backends

get

Get system health on HashiCorp Vault

Check Vault system health

github

Github login on HashiCorp Vault

initialize

Initialize vault on HashiCorp Vault

Initialize a new Vault cluster

issue

Issue pki cert on HashiCorp Vault

Issue a new PKI certificate

kubernetes

Kubernetes login on HashiCorp Vault

list

List acl policies on HashiCorp Vault

List ACL policies

list

List audit devices on HashiCorp Vault

List enabled audit devices

list

List auth methods on HashiCorp Vault

List enabled auth methods

list

List kv secrets on HashiCorp Vault

List secrets in a KV v2 engine path

list

List mounts on HashiCorp Vault

List mounted secrets engines

list

List token accessors on HashiCorp Vault

List token accessors (requires sudo)

lookup

Lookup lease on HashiCorp Vault

Lookup a lease by ID

lookup

Lookup self token on HashiCorp Vault

Lookup details about the current Vault token

map

Map github team on HashiCorp Vault

Map a GitHub team to Vault policies

read

Read kv metadata on HashiCorp Vault

Read metadata for a KV v2 secret

read

Read kv secret on HashiCorp Vault

Read a secret from KV v2 engine

renew

Renew lease on HashiCorp Vault

Renew a lease

renew

Renew self token on HashiCorp Vault

Renew the current Vault token

revoke

Revoke lease on HashiCorp Vault

Revoke a lease

revoke

Revoke pki cert on HashiCorp Vault

Revoke a PKI certificate

revoke

Revoke self token on HashiCorp Vault

Revoke the current Vault token

rotate

Rotate transit key on HashiCorp Vault

Rotate a Transit key

seal

Seal vault on HashiCorp Vault

Seal the Vault

unseal

Unseal vault on HashiCorp Vault

Unseal the Vault with a key share

userpass

Userpass login on HashiCorp Vault

write

Write kv secret on HashiCorp Vault

Create or update a secret in KV v2 engine

What the HashiCorp Vault MCP Server unlocks

Connect your HashiCorp Vault instance to any AI agent to automate secrets management and security operations through natural language.

What you can do

Secrets Management — Read, write, and list KV secrets directly from your secure mounts using the KV engine.
Dynamic Credentials — Generate on-demand credentials for Databases, AWS, and PKI certificates without manual intervention.
Token Operations — Create, lookup, and renew tokens to manage session lifecycles and access control.
Transit Encryption — Encrypt and decrypt data using Vault's transit engine to protect sensitive information without exposing keys.
System Administration — Check cluster health, manage mounts, and configure auth methods or ACL policies directly.

How it works

1. Subscribe to this server
2. Provide your Vault Address and Token
3. Start managing your infrastructure security from Claude, Cursor, or any MCP-compatible client

Who is this for?

DevOps Engineers — automate secret rotation and infrastructure provisioning workflows.
Security Teams — audit token accessors and manage ACL policies through conversation.
Developers — fetch development secrets and generate local database credentials without leaving the IDE.

Frequently asked questions about the HashiCorp Vault MCP Server

Can I check the remaining TTL and policies of my current session token?

Yes. Use the lookup_self_token tool. It returns the creation time, TTL, associated policies, and metadata for the token currently in use.

How do I retrieve a specific secret from a KV version 2 engine?

Use the read_kv_secret tool by providing the path to the secret. The agent will fetch the data and present the key-value pairs securely.

Is it possible to generate temporary database credentials through the agent?

Yes. If the database engine is configured, use generate_database_creds with the specific role name to receive a temporary username and password.

We built the connector to HashiCorp Vault. Now put your agents to work. Fully governed.

Vinkius is the AI Gateway with managed hosting. Stop building connectors. Every connection runs inside eight layers of security.

How it works

Infrastructure

Hosted, sandboxed, and live on AWS. You don't provision anything. You don't maintain anything. You connect.

Visibility

Every tool call, every token, every response. Logged and auditable. Data flows direct from HashiCorp Vault to your agent. Nothing is stored on our side. Ever.

Control

Eight governance layers on every request. Sensitive data redacted before it reaches the model. Kill switch if anything goes sideways. Always on.