HashiCorp Vault Connector for AI agents.

50 live capabilities

Manage infrastructure secrets and dynamic credentials with natural language commands.

Live agent request HashiCorp Vault / Connector

Waiting for input…

AI Agent

Why people use HashiCorp Vault

Secure Infrastructure with HashiCorp Vault Secrets Management

This Connector changes the game by letting your AI agent act as the intermediary. Instead of hunting for keys, you just ask your agent to fetch the production API key or generate a temporary database password. It handles the handshake with Vault, retrieves the data, and gives you what you need in seconds.

What Vinkius changes

You get a conversational interface for your entire secrets management infrastructure.

Use it from Claude, ChatGPT, Cursor or another AI client you already have.

One account · 5,900+ Connectors

Real-world use case 01

Emergency Credential Rotation

A security lead notices a leak and asks the agent to rotate_transit_key and revoke_self_token immediately to stop the breach.
Real-world use case 02

Dynamic Cloud Access

A developer needs to run a one-off script and asks the agent to generate_aws_creds for a specific region.
Real-world use case 03

Automated PKI Issuance

An admin asks the agent to issue_pki_cert for a new microservice, handling the complex certificate logic automatically.

Complete set · 50capabilities

The complete HashiCorp Vault capability set.

These are the exact actions your AI can choose when you ask it to work with HashiCorp Vault.

Capability set01 / 13

01—04

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

01 Capability
Approle login
Log in to Vault using AppRole authentication. This makes it easy to manage machine identities.
02 Capability
Create aws role
Generate a new role for AWS resources. This helps automate permissions for your cloud infrastructure.
03 Capability
Generate database creds
Create dynamic, short-lived credentials for your database. This lets your agent get fresh logins for every task.
04 Capability
Read kv metadata
Read the metadata for a specific KV v2 secret. Use this to see when a secret was last updated.

Capability set02 / 13

05—08

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

05 Capability
Read kv secret
Retrieve a secret from a KV v2 engine path. This lets your agent grab the actual value you need.
06 Capability
Configure aws root
Set up your AWS root credentials in the system. Use this for initial cloud environment configuration.
07 Capability
Configure kubernetes auth
Set up authentication for your Kubernetes cluster. This connects your container orchestration to your secrets.
08 Capability
Github login
Log in using a personal access token from GitHub. This lets your agent authenticate using your existing GitHub account.

Capability set03 / 13

09—12

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

09 Capability
Issue pki cert
Issue a new certificate from your PKI engine. This automates the creation of SSL or other certificates.
10 Capability
Kubernetes login
Log in using your Kubernetes authentication credentials. This allows your agent to act on behalf of a K8s service.
11 Capability
List audit devices
View all currently enabled audit devices. Use this to see what actions are being logged.
12 Capability
List auth methods
See a list of all active authentication methods. This helps you see how users can log in.

Capability set04 / 13

13—16

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

13 Capability
List kv secrets
List all secrets stored in a specific KV v2 path. Use this to see what keys are available in a folder.
14 Capability
Configure database
Establish a connection for a specific database. This helps your agent interact with your data layer.
15 Capability
Create acl policy
Define or update a new ACL policy for access control. Use this to set specific permissions for users or machines.
16 Capability
Create approle role
Create or update a specific AppRole role. This is the first step in setting up machine-to-machine identities.

Capability set05 / 13

17—20

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

17 Capability
Create database role
Create a specific role for database access. Use this to define what different users can do in your DB.
18 Capability
Create pki role
Set up a new PKI role for certificate management. This is useful for managing internal certificates.
19 Capability
Create token
Generate a new Vault token for session management. Use this to create temporary access for your agent.
20 Capability
Create transit key
Create a new key for the transit encryption engine. This is the foundation for encrypting data without exposing keys.

Capability set06 / 13

21—24

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

21 Capability
Create userpass user
Create a new user account using username and password. Use this for standard human user authentication.
22 Capability
Decrypt transit
Decrypt sensitive data using the transit engine. This allows your agent to read encrypted values on the fly.
23 Capability
Delete kv secret
Remove the latest version of a KV v2 secret. Use this to clean up old or compromised secrets.
24 Capability
Enable audit device
Turn on an audit device to track system actions. This helps you keep a record of every interaction.

Capability set07 / 13

25—28

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

25 Capability
Enable auth method
Activate a new authentication method in the system. Use this to add things like GitHub or OIDC login.
26 Capability
Enable engine
Turn on a new secrets engine for your instance. This allows you to add new capabilities like AWS or Database support.
27 Capability
Encrypt transit
Encrypt data using the transit engine for secure storage. This keeps your data safe even if the storage is compromised.
28 Capability
Generate approle secret id
Create a new Secret ID for an existing AppRole. This is needed to authenticate your machines to Vault.

Capability set08 / 13

29—32

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

29 Capability
Generate aws creds
Create dynamic, short-lived credentials for AWS. This eliminates the need for long-lived access keys.
30 Capability
Generate pki root
Generate a new root certificate for your PKI setup. Use this to establish your own internal certificate authority.
31 Capability
Get init status
Check if your Vault cluster has been initialized. Use this to verify your system is ready for use.
32 Capability
Get openapi spec
Generate an OpenAPI V3 document for your mounted backends. This helps you understand what your secrets engines can do.

Capability set09 / 13

33—36

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

33 Capability
Get system health
Check the current health status of your Vault cluster. Use this to monitor your infrastructure uptime.
34 Capability
Initialize vault
Perform the initial setup for a new Vault cluster. Use this to get your security environment up and running.
35 Capability
List mounts
View all secrets engines currently mounted. This shows you all the different types of secrets you can manage.
36 Capability
List token accessors
List all token accessors that require sudo. Use this to audit high-privilege sessions.

Capability set10 / 13

37—40

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

37 Capability
Lookup lease
Find details for a specific lease by its ID. This helps you track the remaining life of a dynamic credential.
38 Capability
Lookup self token
Get details about the token currently being used. Use this to check your own permissions and expiration.
39 Capability
Map github team
Link a GitHub team to specific Vault policies. This automates permissions for your developers based on their team.
40 Capability
Renew lease
Extend the duration of an existing lease. Use this to keep a dynamic credential active for longer.

Capability set11 / 13

41—44

4 capabilities in this set.

Part of 50 available through HashiCorp Vault.

41 Capability
Renew self token
Extend the life of your current Vault token. Use this to prevent your session from expiring.
42 Capability
Revoke lease
Cancel an existing lease immediately. Use this to kill a credential if it's no longer needed.
43 Capability
Revoke pki cert
Revoke a previously issued PKI certificate. Use this to invalidate a compromised certificate.
44 Capability
Revoke self token
Cancel the current Vault token session. Use this to log out or kill a session instantly.

Capability set12 / 13

45—47

3 capabilities in this set.

Part of 50 available through HashiCorp Vault.

45 Capability
Rotate transit key
Rotate a key within the transit engine. This refreshes your encryption keys without changing the data.
46 Capability
Seal vault
Lock the Vault to protect its contents. Use this to put the system into a secure, inaccessible state.
47 Capability
Unseal vault
Unlock the Vault using a key share. Use this to bring the system back online after a restart.

Capability set13 / 13

48—50

3 capabilities in this set.

Part of 50 available through HashiCorp Vault.

48 Capability
Userpass login
Log in using standard username and password credentials. Use this for simple human authentication.
49 Capability
Write kv secret
Create or update a secret in a KV v2 engine. Use this to store new keys or update existing ones.
50 Capability
List acl policies
List all existing ACL policies in the system. Use this to audit who has access to what.

Set up in minutes

One URL. Then ask HashiCorp Vault to work.

Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use HashiCorp Vault from the conversation.

Choose your client

Live preview

Advanced clients IDE · CLI

Claude · Web + desktop

Official guide ↗

Connector URL · ready to paste

Streamable HTTP

https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp

Step 01

Open Connectors

In Claude Web or Claude Desktop, open Settings and choose Connectors.
Step 02

Add the URL

Choose Add custom connector, name it HashiCorp Vault, and paste the URL above.
Step 03

Turn it on in chat

Select +, open Connectors, and enable HashiCorp Vault for the conversation.

ChatGPT · Web + desktop

Official guide ↗

Connector URL · ready to paste

Streamable HTTP

https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp

Step 01

Open MCP settings

On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
Step 02

Add the URL

Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the HashiCorp Vault URL.
Step 03

Save and start

Save the connection and enable HashiCorp Vault in your conversation. Desktop may ask you to restart once.

Cursor · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "hashicorp-vault": {
      "url": "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"
    }
  }
}

Step 01

Open MCP Settings

Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
Step 02

Add the server config

Paste the JSON configuration above into the mcp.json file that opens
Step 03

Save the file

Cursor will automatically detect the new Connector
Step 04

Start using HashiCorp Vault

Open Agent mode in chat and ask: "Using HashiCorp Vault, help me...". 50 tools available

VS Code Copilot · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "hashicorp-vault": {
      "url": "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"
    }
  }
}

Step 01

Create MCP config

Create a .vscode/mcp.json file in your project root
Step 02

Add the server config

Paste the JSON configuration above
Step 03

Enable Agent mode

Open GitHub Copilot Chat and switch to Agent mode using the dropdown
Step 04

Start using HashiCorp Vault

Ask Copilot: "Using HashiCorp Vault, help me...". 50 tools available

Windsurf · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "hashicorp-vault": {
      "url": "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"
    }
  }
}

Step 01

Open MCP Settings

Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
Step 02

Add the server

Paste the JSON configuration above into mcp_config.json
Step 03

Save and reload

Windsurf will detect the new server automatically
Step 04

Start using HashiCorp Vault

Open Cascade and ask: "Using HashiCorp Vault, help me...". 50 tools available

Cline · IDE configuration

Official guide ↗

Advanced setup

{
  "mcpServers": {
    "hashicorp-vault": {
      "url": "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"
    }
  }
}

Step 01

Open Cline MCP Settings

Click the Connectors icon in the Cline sidebar panel
Step 02

Add remote server

Click "Add Connector" and paste the configuration above
Step 03

Enable the server

Toggle the server switch to ON
Step 04

Start using HashiCorp Vault

Ask Cline: "Using HashiCorp Vault, help me...". 50 tools available

Claude Code · Terminal command

Official guide ↗

Advanced setup

claude mcp add hashicorp-vault --transport http "https://edge.vinkius.com/vk_preview_lgB4qaVCQ3JeVdH9vUAFUfoB5Ytd1cCr5alMptaW/mcp"

Step 01

Install Claude Code

Run npm install -g @anthropic-ai/claude-code if not already installed
Step 02

Add the Connector

Run the command above in your terminal
Step 03

Verify the connection

Run claude mcp to list connected servers, or type /mcp inside a session
Step 04

Start using HashiCorp Vault

Ask Claude: "Using HashiCorp Vault, show me...". 50 tools are ready

Where the request belongs

Work HashiCorp Vault can move forward.

Built around the request

This is for the security-conscious engineer who is tired of manual secret rotation and the anxiety of hardcoded credentials. It's for teams who need to move fast without breaking security protocols.

01

DevOps Engineer

Automates secret rotation and infrastructure provisioning for cloud environments.

02

Security Analyst

Audits token accessors and manages ACL policies during security reviews.

03

Backend Developer

Fetches development secrets and generates local database credentials without leaving the IDE.

Build the capability set

Each Connector adds new actions and data without changing how you work.

Browse Connectors

01 9 capabilities

Infisical

Manage secrets infrastructure via AI. list, create, update, and audit secrets across environments with end-to-end encryption.

02 10 capabilities

CyberArk Privilege Cloud

Manage privileged access via CyberArk. audit secure safes, checkout vaulted account passwords, monitor users, and terminate sessions directly from any AI agent.

03 10 capabilities

Authing

Cloud-native identity and access management platform. manage users, roles, and security logs via AI.

04 12 capabilities

Doppler

Manage secrets and environment variables via Doppler. list projects, audit secrets, and track activity logs from any AI agent.

05 5 capabilities

Vibrato

Manage secrets and environment variables securely across your development and deployment pipeline with encrypted vaults.

06 12 capabilities

Hudu

Document your IT infrastructure with password vaults, knowledge bases, and asset tracking built for managed service providers.

Bring your own AI

Change the model, client or framework. Keep HashiCorp Vault connected.

Before you connect

Questions about HashiCorp Vault.

The practical details behind the request, access and result.

What is the HashiCorp Vault MCP used for?

It lets your AI agent interact directly with your Vault instance. You can use it to fetch secrets, manage tokens, and generate dynamic credentials for things like AWS or databases without leaving your chat interface.

Can I use the HashiCorp Vault MCP to manage my production secrets?

Yes, that's exactly what it's built for. You can ask your agent to read, write, or list KV secrets, making it much easier to manage production environment variables securely.

Does the HashiCorp Vault MCP support AWS dynamic credentials?

Yes, it can generate short-lived AWS credentials on demand. This helps you avoid using long-lived IAM keys by letting your agent create them only when you need them.

How does the HashiCorp Vault MCP handle encryption?

It connects to Vault's transit engine, allowing your agent to encrypt and decrypt data. This means you can protect sensitive information without ever having to handle the encryption keys directly.

Can I use the HashiCorp Vault MCP to manage PKI certificates?

Absolutely. Your agent can issue new certificates, generate PKI roots, and revoke certificates through natural language commands, simplifying your certificate lifecycle.

Is the HashiCorp Vault MCP safe for my security team?

It's designed with security in mind. It allows for precise control over ACL policies and token management, ensuring that your agent only performs actions that your Vault configuration allows.

Can I check the remaining TTL and policies of my current session token?

Yes. Use the lookup_self_token capability. It returns the creation time, TTL, associated policies, and metadata for the token currently in use.

How do I retrieve a specific secret from a KV version 2 engine?

Use the read_kv_secret capability by providing the path to the secret. The agent will fetch the data and present the key-value pairs securely.

Is it possible to generate temporary database credentials through the agent?

Yes. If the database engine is configured, use generate_database_creds with the specific role name to receive a temporary username and password.

One connection away

Give your agent a direct line to HashiCorp Vault.

Connect HashiCorp Vault once. Keep it beside 5,900+ managed Connectors when the next task needs more.

Explore every Connector No credit card required · Free tier available