HashiCorp Vault

You run an MCP server that exposes Vault KV operations over a Streamable HTTP API and secures access with optional token authentication and TLS. You can read, write, list, and delete secrets from HashiCorp Vault through a centralized MCP endpoint, then connect your clients (like Gemini CLI, Claude Desktop, or other MCP-enabled tools) to the same API surface.

How to use

Connect your MCP client to the server and perform vault_kv_read, vault_kv_create, vault_kv_list, and vault_kv_delete operations against HashiCorp Vault. If you enable authentication, include the proper Bearer token in your requests. When TLS is enabled, use HTTPS endpoints and trusted certificates. You can access health and MCP endpoints to manage connections and run tool invocations that read or modify Vault secrets.

Common usage patterns include: wiring your MCP client to the server’s /mcp endpoint, authenticating with a token if configured, and issuing tool commands to read or persist secrets at specified paths and mounts. Use the provided tool names to perform the exact Vault KV operations, and rely on the server’s responses to confirm success or report errors.

How to install

Prerequisites: ensure you have Node.js 18 or later and a running HashiCorp Vault server with a valid token.

Install dependencies and build the MCP server package.

npm install
npm run build

Additional configuration and usage notes

Environment variables you may configure for Vault access and MCP server behavior include the following. You can set them in your environment or a .env file as appropriate for your deployment.

Vault configuration (required for Vault interactions):

VAULT_ADDR=http://127.0.0.1:8200
VAULT_TOKEN=your-vault-token
VAULT_URL=${VAULT_ADDR}/v1
VAULT_TIMEOUT=5000
VAULT_CACERT=/path/to/ca.crt

Server configuration and security

Configure the MCP server to expose either an HTTP or HTTPS endpoint and to protect the MCP surface with a token if desired.

HTTP or HTTPS ports and tokens are controlled via environment variables. A TLS-enabled setup will require TLS key/cert/CA files.

Key environment variables include the following.

MCP_PORT=3000
MCP_AUTH_TOKEN=your-secure-token-here
MCP_TLS_ENABLED=false
MCP_TLS_KEY=./certs/mcp-server.key
MCP_TLS_CERT=./certs/mcp-server.crt
MCP_TLS_CA=./certs/ca.crt

Using with clients

You can connect your MCP clients to the server using HTTP or HTTPS and provide any required authentication headers. The client may need to specify the endpoint at /mcp and include an Authorization header when authentication is enabled.

Examples of client configuration include providing the MCP URL, transport, headers, and, if needed, an Authorization header with a Bearer token.

Tool examples and Vault KV operations

The server offers tools to interact with Vault KV as described below. Each tool performs a specific operation on Vault secrets.

• vault_kv_read: Read secrets from Vault at a given path, with optional version and mount point.

• vault_kv_create: Create or write secrets at a specified path.

• vault_kv_list: List secrets under a path in a mount point.

• vault_kv_delete: Delete the latest version of secrets at a path.

Available tools

vault_kv_read

Read secrets from Vault at a specified path, with optional version and mount point.

vault_kv_create

Create or write secrets to Vault at a specified path.

vault_kv_list

List secrets under a specified path in a given mount point.

vault_kv_delete

Delete the latest version of secrets from Vault at a specified path.