An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect HashiCorp Vault to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Control your entire secrets infrastructure through natural language.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 50 capabilities

We ship only the actions that matter.

Capability set01 / 13

01-04

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 01

    Create aws role

    This capability creates a new AWS role within your Vault configuration.

  2. 02

    Generate database creds

    Use this to produce dynamic, on-demand credentials for your databases.

  3. 03

    List audit devices

    This capability returns a list of all currently enabled audit devices.

  4. 04

    List auth methods

    Get a list of all auth methods currently enabled in your Vault instance.

Capability set02 / 13

05-08

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 05

    List kv secrets

    This capability lists the secrets found at a specific KV v2 engine path.

  2. 06

    Create acl policy

    Use this to create or update an ACL policy for access control.

  3. 07

    Create pki role

    This capability sets up a new PKI role for certificate management.

  4. 08

    Create token

    Generate a new Vault token to manage session access.

Capability set03 / 13

09-12

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 09

    Create transit key

    This capability creates a new key for use with the Transit engine.

  2. 10

    Decrypt transit

    Use the Transit engine to decrypt sensitive data.

  3. 11

    Delete kv secret

    This capability removes the latest version of a secret in a KV v2 engine.

  4. 12

    Enable auth method

    Enable a new authentication method for your Vault instance.

Capability set04 / 13

13-16

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 13

    Enable engine

    Use this to enable a new secrets engine.

  2. 14

    Generate approle secret ID

    This capability generates a new Secret ID for an existing AppRole.

  3. 15

    Get init status

    Check whether your Vault cluster has been initialized.

  4. 16

    Get openapi spec

    Generate an OpenAPI V3 document for your mounted backends.

Capability set05 / 13

17-20

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 17

    Get system health

    Check the current health status of your Vault system.

  2. 18

    Initialize vault

    Use this to initialize a brand new Vault cluster.

  3. 19

    List mounts

    Get a list of all currently mounted secrets engines.

  4. 20

    List token accessors

    List token accessors, which requires sudo privileges.

Capability set06 / 13

21-24

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 21

    Lookup self token

    Retrieve the specific details of your current Vault token.

  2. 22

    Revoke self token

    Immediately revoke the token you are currently using.

  3. 23

    Rotate transit key

    Use this to rotate an existing Transit key.

  4. 24

    Write kv secret

    Create or update a secret within a KV v2 engine.

Capability set07 / 13

25-28

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 25

    Approle login

    Log in to Vault using AppRole authentication.

  2. 26

    Configure aws root

    Set up the root credentials for AWS integration.

  3. 27

    Configure database

    Use this to set up a connection to a database.

  4. 28

    Configure kubernetes auth

    Configure Kubernetes as an authentication method.

Capability set08 / 13

29-32

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 29

    Create approle role

    Create or update a role for AppRole authentication.

  2. 30

    Create database role

    This capability creates a new role for database credential generation.

  3. 31

    Create userpass user

    Create a new user using the Userpass authentication method.

  4. 32

    Enable audit device

    Enable a new audit device to track Vault activity.

Capability set09 / 13

33-36

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 33

    Encrypt transit

    Use the Transit engine to encrypt sensitive data.

  2. 34

    Generate aws creds

    Produce dynamic AWS credentials on the fly.

  3. 35

    Generate pki root

    Generate a new root certificate for the PKI engine.

  4. 36

    Github login

    Log in to Vault using a GitHub personal access token.

Capability set10 / 13

37-40

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 37

    Issue pki cert

    Issue a new certificate through the PKI engine.

  2. 38

    Kubernetes login

    Log in to Vault using Kubernetes authentication.

  3. 39

    List acl policies

    Get a list of all existing ACL policies.

  4. 40

    Lookup lease

    Retrieve information about a specific lease using its ID.

Capability set11 / 13

41-44

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 41

    Map github team

    Map a specific GitHub team to Vault policies.

  2. 42

    Read kv metadata

    Retrieve metadata for a secret in the KV v2 engine.

  3. 43

    Read kv secret

    Read the actual data from a KV v2 engine secret.

  4. 44

    Renew lease

    Extend the duration of an existing lease.

Capability set12 / 13

45-47

3 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 45

    Renew self token

    Renew the token you are currently using.

  2. 46

    Revoke lease

    Revoke a specific lease immediately.

  3. 47

    Revoke pki cert

    Revoke a certificate issued by the PKI engine.

Capability set13 / 13

48-50

3 capabilities in this set.

Part of 50 available through HashiCorp Vault.

  1. 48

    Seal vault

    Seal the Vault to prevent further access.

  2. 49

    Unseal vault

    Unseal the Vault using a provided key share.

  3. 50

    Userpass login

    Log in to Vault using a username and password.

Real work

What teams actually run

01

On-demand Database Access

Ask your agent to generate temporary database credentials for a specific task.

02

Automated Secret Rotation

Use the agent to update or rotate KV secrets during deployment workflows.

03

Infrastructure Security Auditing

Quickly list enabled auth methods or audit devices to check system configuration.

04

Data Encryption Services

Offload encryption and decryption tasks to the Transit engine via the agent.

Automate a task

Put HashiCorp Vault to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

HashiCorp Vault works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put HashiCorp Vault to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

1374ms average. Fast in production.

HashiCorp Vault is checked daily against the live service.

Daily averagePeak 1742ms
Oct 3Today
Fastest day
1127ms
Slowest day
1742ms
14-day trend
Improving-8%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 50 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of HashiCorp Vault, so you can see the experience inside your AI.

It does not authenticate your account with HashiCorp Vault. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

HashiCorp Vault Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — HashiCorp Vault capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "hashicorp-vault-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up HashiCorp Vault in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work HashiCorp Vault owners hand off.

This MCP is built for technical teams managing sensitive infrastructure and identity.

  • 01

    DevOps Engineers

    Automate secret rotation and infrastructure provisioning via the AI agent.

  • 02

    Security Teams

    Audit token access and manage ACL policies through natural language.

  • 03

    Developers

    Fetch development secrets and generate database credentials directly in the IDE.

FAQ

Questions HashiCorp Vault owners ask.

  • 01

    How do I connect this MCP to my Vault instance?

    You simply subscribe to the MCP on Vinkius and provide your Vault Address and a valid Token. Once connected, it is ready to use in any compatible client.

  • 02

    Which AI clients can I use with this MCP?

    You can use this MCP with any compatible client, including Claude, Cursor, and Windsurf.

  • 03

    Does this MCP store my Vault secrets?

    No. This MCP acts as a bridge to your existing Vault instance. Vinkius manages the connection, but your secrets remain within your Vault infrastructure.

  • 04

    Can I use this for dynamic AWS credentials?

    Yes. The MCP includes capabilities to generate dynamic AWS credentials and create AWS roles directly.

  • 05

    Is it possible to manage ACL policies through the AI?

    Yes. You can create, update, and list ACL policies using the capabilities provided in this MCP.

  • 06

    Can I check the remaining TTL and policies of my current session token?

    Yes. Use the lookup_self_token capability. It returns the creation time, TTL, associated policies, and metadata for the token currently in use.

  • 07

    How do I retrieve a specific secret from a KV version 2 engine?

    Use the read_kv_secret capability by providing the path to the secret. The agent will fetch the data and present the key-value pairs securely.

  • 08

    Is it possible to generate temporary database credentials through the agent?

    Yes. If the database engine is configured, use generate_database_creds with the specific role name to receive a temporary username and password.

Explore

More in Fort Knox

Suggestions

Connect HashiCorp Vault to Claude, Cursor, ChatGPT & more