An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Cyberark Privilege Cloud to ChatGPT and Claude

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Control privileged access through natural conversation.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through CyberArk.

  1. 01

    Delete account

    Deletes a privileged account from the CyberArk Vault. This is used during system decommissioning to ensure the CPM stops attempting failed rotations.

  2. 02

    Get account

    Retrieves detailed properties for a specific vaulted account. You'll use this to check account details before attempting a rotation or interaction.

  3. 03

    List accounts

    Searches and lists privileged accounts vaulted in CyberArk. It returns details like platform, Safe allocation, address, and rotation status.

  4. 04

    List safes

    Lists all secure Safes within CyberArk. Use this to find where specific tier-0 credentials or local admin passwords are stored.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through CyberArk.

  1. 05

    Retrieve password

    Retrieves a clear-text password for an account via a check-out process. This requires a mandatory justification and triggers SIEM alerts.

  2. 06

    Get safe

    Fetches metadata and specific details for a single PAM Safe.

  3. 07

    List groups

    Lists CyberArk Vault User Groups. This helps you verify logical access architectures and RBAC rules.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through CyberArk.

  1. 08

    List users

    Lists all CyberArk users, including both local and synchronized directory users. It identifies admins, auditors, and users running PSM sessions.

  2. 09

    Terminate session

    Forcibly ends an active PSM or PSMP privileged session. This acts as a direct incident response capability to stop unauthorized activity.

  3. 10

    Add account

    Provisions a new privileged account into a Vault Safe. You must map it to a Platform ID to manage its rotation lifecycle.

Real work

What teams actually run

01

Incident Response

An analyst detects anomalous behavior and tells the agent to terminate the active session immediately.

02

Emergency Maintenance

A DevOps engineer retrieves a root password for a database server using a specific justification.

03

Compliance Auditing

An auditor asks the agent to list all users in a specific group to verify RBAC implementation.

04

Account Onboarding

An administrator provisions a new service account into a secure Safe with the correct rotation settings.

Automate a task

Put CyberArk to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

CyberArk works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put CyberArk to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

1102ms average. Fast in production.

CyberArk is checked daily against the live service.

Daily averagePeak 1155ms
Oct 15Today
Fastest day
654ms
Slowest day
1155ms
14-day trend
Slowing+77%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of CyberArk, so you can see the experience inside your AI.

It does not authenticate your account with CyberArk. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

CyberArk Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_18gJHbsKGjtg9GOn25i2jhe0oFuy772lTZzUa9w1/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CyberArk capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "cyberark-privilege-cloud-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_18gJHbsKGjtg9GOn25i2jhe0oFuy772lTZzUa9w1/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up CyberArk in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work CyberArk owners hand off.

Security and IT professionals who need to manage privileged access without switching between multiple browser tabs and consoles.

  • 01

    Security Analysts

    They use the agent to monitor account status and kill suspicious sessions in real time.

  • 02

    IT Administrators

    They onboard service accounts and manage safe configurations through natural language.

  • 03

    Auditors

    They query users, groups, and account properties to confirm compliance with security policies.

  • 04

    DevOps Engineers

    They get temporary credentials for automated tasks while maintaining a full audit trail.

FAQ

Questions CyberArk owners ask.

  • 01

    How do I connect this MCP to my CyberArk environment?

    You need to provide your CyberArk Subdomain and a Bearer access token generated via a Service User client_credentials flow. Once entered in Vinkius, you can connect your AI client with one click.

  • 02

    Is password retrieval secure?

    Yes. The retrieve_password capability is a highly audited endpoint. It requires a mandatory justification for every request, which triggers alerts in your SIEM.

  • 03

    Can I stop a user session using my AI agent?

    Yes. You can use the terminate_session capability to forcibly end active PSM or PSMP sessions instantly.

  • 04

    Which AI clients can I use with this MCP?

    This MCP works with any compatible client, including Claude, Cursor, Windsurf, and VS Code.

  • 05

    Do I need to use the CyberArk web interface?

    No. This MCP allows you to perform most common tasks, like onboarding accounts or auditing safes, directly through your AI agent.

  • 06

    Can my agent retrieve a privileged password for an emergency maintenance task?

    Yes. Use the 'retrieve_password' capability. You must provide the account ID and a justification reason. The agent pulls the secret from the Vault, and the action is fully audited in CyberArk's system logs for compliance.

  • 07

    How do I terminate a suspicious active session via the agent?

    Provide the session ID to the 'terminate_session' capability. The agent will dispatch an instant interrupt signal to the CyberArk platform, killing the live SSH or RDP session immediately to prevent unauthorized actions.

  • 08

    Is it possible to add new service accounts to a Safe through chat?

    Absolutely. Use the 'add_account' capability. You'll need to specify the account name, address, username, platform ID, and the destination Safe. Your agent will onboard the credential and link it to the CPM for automated rotation.

Explore

More in Fort Knox

Suggestions

Connect CyberArk to Claude, Cursor, ChatGPT & more