Vault MCP

🚀 HashiCorp Vault MCP Server

A server implementation of the Model Context Protocol (MCP) that provides a secure interface with HashiCorp Vault, enabling large language models (LLMs) and other MCP clients to interact with Vault's secret and policy management capabilities.

🚀 Quick Start

Example Configuration

Add the Vault MCP server to the Cursor configuration, set the environment variables, and start the service:

VAULT_ADDR=https://vault.example.com:8200 VAULT_TOKEN=your_token docker run -p 3000:3000 ashgw/vault-mcp:latest

Testing Functionality

1. Create a policy:

   policy_create --name app_read_only --rules '{"path": "/secret/app/*", "capabilities": ["read"]}'
   

2. List all secret paths:

   ls vault://secrets
   

3. Read a specific secret:

   cat vault://secrets/myapp/config
   

✨ Features

Utility Functions

Secret Operations

• secret_create: Create a secret.
• secret_read: Read the content of a secret.
• secret_delete: Delete a specified secret.

Policy Management

• policy_create: Create a new Vault policy, specifying the paths allowed for access.

Resource Types

Secret Resources

• vault://secrets: List all available secret paths.

Policy Resources

• vault://policies: List all defined Vault policies.

Automatic Policy Generation

Generate corresponding policy content by specifying paths and permissions. For example:

{
  "policy_name": "app_read_only",
  "rules": {
    "path": "/secret/app/*",
    "capabilities": ["read"]
  }
}

📦 Installation

There are different ways to use it depending on your setup.

Using Cursor (Recommended)

Add the following content to the Cursor MCP configuration:

{
  "mcpServers": {
    "Vault MCP": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "VAULT_ADDR=https://your-vault-server:8200",
        "-e",
        "VAULT_TOKEN=hvs.your-vault-token",
        "ashgw/vault-mcp:latest"
      ]
    }
  }
}

If you wish to specify a particular Docker image version (e.g., 20250413-165732), use that tag instead of latest. You can browse the available versions on Docker Hub.

After adding, you can use the following prompt:

"Read the Vault secret at path apps/myapp/config"

Cursor will automatically route the request to the MCP server. Check if it's working properly, and the interface should display a green status.


Manually Running Docker

Set the environment variables VAULT_ADDR and VAULT_TOKEN, and map port 3000:

docker run -it --rm -e "VAULT_ADDR=https://your-vault-server:8200" -e "VAULT_TOKEN=your-vault-token" -p 3000:3000 ashgw/vault-mcp:latest

Building from Source Code

Clone the repository and run:

git clone git@github.com:ashgw/vault-mcp.git
cd vault-mcp
go run main.go

📚 Documentation

Overview

With this implementation, LLMs can perform the following operations:

• Securely manage secrets through a structured API.
• Create and manage policies.
• Discover and list resources.
• Automate policy generation.

⚠️ Important Note

• Ensure the correctness of the Vault server address and token.
• Securely manage tokens to prevent leakage.
• It is recommended to use a trusted network in a production environment.

💡 Community and Support

For help or feedback, please visit the HashiCorp Forums or contact official support.