How to Use the HashiCorp Vault MCP in Windsurf

Q: How do I connect HashiCorp Vault to Windsurf?

Open your /.codeium/windsurf/mcpconfig.json file or use the Settings → Cascade → MCP Servers UI. Add the HashiCorp Vault server configuration under mcpServers, then click Refresh in the MCP panel. Cascade auto-discovers the 50 available tools immediately.

Q: Can Windsurf read my HashiCorp Vault KV secrets?

Yes. Once authenticated, Cascade uses the readkvsecret tool to pull specific paths from your KV v2 engine. It injects those values directly into your codebase or environment files during development.

Q: Does Windsurf support HashiCorp Vault dynamic AWS credentials?

Cascade can generate temporary AWS IAM roles using the generateawscreds tool. It automatically requests the credentials and applies them to your local AWS profile or project configuration.

Q: How do I check if the cluster is unsealed?

Ask your agent to verify the cluster status. It will run getsystemhealth and getinitstatus to confirm the node is active. If the cluster is locked, it can execute unsealvault provided you supply the key shares.

Windsurf agent autonomously manages secrets and dynamic credentials in HashiCorp Vault.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect HashiCorp Vault MCP to Windsurf

Create your Vinkius account to connect HashiCorp Vault to Windsurf and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup HashiCorp Vault with Windsurf

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Autonomous secret management in Windsurf

Cascade uses `approle_login` or `userpass_login` to authenticate against your cluster without prompting you for every step. Once connected, your agent pulls environment variables directly from the source using `read_kv_secret` and writes new configurations back via `write_kv_secret`. You don't have to manually copy-paste tokens into your environment files anymore. Set a goal to rotate your application's API keys, and Windsurf will execute `delete_kv_secret` on the old versions before generating new ones.

Chain dynamic database and AWS credentials

This MCP Server lets Windsurf provision short-lived access tokens on demand. When you ask Cascade to deploy a test stack, it runs `generate_aws_creds` to get temporary IAM roles and `generate_database_creds` for immediate Postgres access. The agent handles the entire lifecycle autonomously. If a deployment takes longer than expected, Windsurf detects the expiration and triggers `renew_lease` to keep the session alive, finally hitting `revoke_lease` when the job finishes.

Direct encryption workflows

Windsurf can build out your application's cryptography layer by calling `encrypt_transit` and `decrypt_transit` directly through the HashiCorp Vault integration. You tell Cascade to implement field-level encryption for user emails, and it writes the exact implementation logic required. If you need to cycle your encryption keys, the agent executes `rotate_transit_key` and updates your backend services to match. No manual intervention is needed.

Setup guide

Set up HashiCorp Vault MCP in Windsurf

Prerequisites

Windsurf IDE installed (macOS, Windows, or Linux)
Active Vinkius subscription with a valid endpoint token

1

Open MCP configuration

Click the Cascade assistant icon in the sidebar, then click the hammer icon (🔨) at the top of the panel. Select "Configure" to open ~/.codeium/windsurf/mcp_config.json.
2

Add the HashiCorp Vault MCP

Paste the JSON snippet shown on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Refresh MCPs

Go back to the hammer icon (🔨) in Cascade and click "Refresh". Windsurf will detect the new server. No full restart is needed — the connection is hot-reloaded.
4

Verify in Cascade

Start a new Cascade conversation and ask something like "Show my HashiCorp Vault payment history." If connected, Cascade will call the HashiCorp Vault tools directly. You will see a green dot next to the server name in the MCP panel.

mcp_config.json

{
  "mcpServers": {
    "hashicorp-vault-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by HashiCorp Vault. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect HashiCorp Vault now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about HashiCorp Vault MCP in Windsurf

Open your `~/.codeium/windsurf/mcp_config.json` file or use the Settings → Cascade → MCP Servers UI. Add the HashiCorp Vault server configuration under `mcpServers`, then click Refresh in the MCP panel. Cascade auto-discovers the 50 available tools immediately.

Yes. Once authenticated, Cascade uses the `read_kv_secret` tool to pull specific paths from your KV v2 engine. It injects those values directly into your codebase or environment files during development.

Cascade can generate temporary AWS IAM roles using the `generate_aws_creds` tool. It automatically requests the credentials and applies them to your local AWS profile or project configuration.

Ask your agent to verify the cluster status. It will run `get_system_health` and `get_init_status` to confirm the node is active. If the cluster is locked, it can execute `unseal_vault` provided you supply the key shares.

The MCP protocol routes your raw plaintext and ciphertext strictly between your local machine and your cluster. Windsurf never caches the output of `decrypt_transit` or `encrypt_transit` on external servers. Your cryptographic operations remain entirely within your controlled environment.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript