How to Use the HashiCorp Vault MCP in Vercel AI SDK

Q: How do I connect the Vercel AI SDK to my HashiCorp Vault server?

You use the Vercel AI SDK's createMCPClient with the Vinkius endpoint URL for this server. Your agent then gets access to all the Vault tools like readkvsecret. The Vinkius platform handles the authentication token for you.

Q: Can my agent create new Vault tokens with this MCP server?

Yes. The createtoken tool lets your agent generate new Vault tokens with specific policies and TTLs. You can also manage the lifecycle of the agent's own token with renewselftoken and revokeselftoken.

Q: Can I use the Vercel AI SDK to manage HashiCorp Vault access policies?

Absolutely. Your agent can use createaclpolicy to define new access rules on the fly. You can also use listaclpolicies to display existing policies within your application's UI.

Q: What's the best way to handle app authentication with HashiCorp Vault and the Vercel AI SDK?

Use AppRole auth. Your agent can use createapprolerole to set up a role, then generateapprolesecretid to get credentials for a specific application instance. This is much safer than passing around static tokens.

Stream HashiCorp Vault secrets and dynamic credentials directly into your UI with the Vercel AI SDK. No more loading spinners for security data.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HashiCorp Vault MCP to Vercel AI SDK

Create your Vinkius account to connect HashiCorp Vault to Vercel AI SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HashiCorp Vault with Vercel AI SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Manage Secrets in Your UI

Let your users manage Vault secrets without leaving your app. Your AI client can `read_kv_secret` to display configurations, or `write_kv_secret` to update them. Since the Vercel AI SDK streams results, the UI updates instantly as the data arrives from Vault. You can also build interfaces to browse secrets. Your agent can call `list_kv_secrets` to populate a file-tree view, then `read_kv_metadata` to show version history. It gives users a clear picture of their secret landscape right in the frontend.

Generate Credentials On-Demand

Stop shipping static keys. When a user needs access, your agent calls `generate_aws_creds` or `generate_database_creds`. The Vercel AI SDK streams the temporary credentials right to the user's screen, ready for them to copy and use. These credentials aren't permanent. Your agent can `lookup_lease` to show the user exactly how much time is left. When they're done, the lease expires automatically, or you can build a button that triggers `revoke_lease` for an immediate cleanup.

Monitor Vault Health in Real-Time

Build a live dashboard for your Vault cluster with this MCP Server. Your agent can poll `get_system_health` and stream the status directly into a component. You'll see the cluster's state—sealed, unsealed, or standby—without refreshing the page. You can also check if a new Vault instance is ready by calling `get_init_status`. Or use `list_mounts` and `list_auth_methods` to give admins a live view of how the server is configured. All the data pipes right into your UI.

Setup guide

Set up HashiCorp Vault MCP in Vercel AI SDK

Prerequisites

Node.js 18+ and a TypeScript project
ai + @modelcontextprotocol/sdk packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies

Run npm install ai @modelcontextprotocol/sdk plus your preferred model provider (e.g. @ai-sdk/openai).
2

Create the Streamable HTTP transport

Use StreamableHTTPClientTransport with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and use tools

Call mcpClient.tools() to auto-discover all HashiCorp Vault tools. Pass them directly to generateText() or streamText() — no manual schema definitions needed.
4

Works with any model provider

Swap openai("gpt-4o") for any AI SDK provider — Anthropic, Google, Mistral. The MCP tools work identically across all supported models.

index.ts

import { experimental_createMCPClient as createMCPClient } from "ai";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp";
import { generateText } from "ai";
import { openai } from "@ai-sdk/openai";

const transport = new StreamableHTTPClientTransport(
  new URL("https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp")
);

const mcpClient = await createMCPClient({ transport });
const tools = await mcpClient.tools();

const { text } = await generateText({
  model: openai("gpt-4o"),
  tools,
  prompt: "List recent HashiCorp Vault transactions",
});

console.log(text);
await mcpClient.close();

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HashiCorp Vault. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HashiCorp Vault now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HashiCorp Vault MCP in Vercel AI SDK

You use the Vercel AI SDK's `createMCPClient` with the Vinkius endpoint URL for this server. Your agent then gets access to all the Vault tools like `read_kv_secret`. The Vinkius platform handles the authentication token for you.

Yes. The `create_token` tool lets your agent generate new Vault tokens with specific policies and TTLs. You can also manage the lifecycle of the agent's own token with `renew_self_token` and `revoke_self_token`.

Absolutely. Your agent can use `create_acl_policy` to define new access rules on the fly. You can also use `list_acl_policies` to display existing policies within your application's UI.

Use AppRole auth. Your agent can use `create_approle_role` to set up a role, then `generate_approle_secret_id` to get credentials for a specific application instance. This is much safer than passing around static tokens.

No. Your connection is proxied, but the MCP server itself runs in an ephemeral, zero-trust sandbox. Vinkius never logs or inspects the actual secret data, credentials, or encryption keys passed through tools like `read_kv_secret` or `generate_aws_creds`.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript