How is the agent token scoped?

Through standard Vault policies. Mint a token with only the policies the workflow needs — for a KV-read workflow, that is a single read capability against the relevant path.

Can it issue dynamic database credentials?

No. The server exposes mount, KV v2 and PKI tools only — sixteen in total, all documented in its README. Vault's database secrets engine has no tool here, so dynamic database credentials have to go through the Vault API or CLI.

Yes, Vault Enterprise namespaces are supported via VAULT_NAMESPACE. Use them to keep agent identities isolated from production human identities.

Approle / AWS auth instead of token?

Not in the current release — token auth only. Wrap with a short-lived token issued by your auth flow of choice and rotate it via the same mechanism you use for other Vault tokens.

HashiCorp Vault

Name: Top MCPs — curated MCP directory
Creator: Top MCPs
License: https://creativecommons.org/licenses/by/4.0/

Official

Read dynamic and static secrets from HashiCorp Vault inside agent workflows.

Score 73(?)HashiCorpMPL-2.0 58Verified Aug 24, 2026Top MCPs for Security →

Install View on GitHub

Quick answer

What it does

Exposes sixteen tools over three groups — mount management (list/create/delete), KV v2 (list, read, write, delete), and PKI (enable, issuers, roles, issue certificate). There is no database secrets-engine tool.

Best for

KV v2 secret reads
PKI certificate issuance
Enabling and inspecting mounts
Per-token scoped agent access

Not for

Teams without an existing Vault deployment
Single-developer secret stores

Source: top-mcps.com/mcp/vault — verified Aug 2026

Setup recipe

Pick your client, then follow the three steps.

Install

claude_desktop_config.jsonjson

{
  "mcpServers": {
    "vault": {
      "command": "go",
      "args": [
        "install",
        "github.com/hashicorp/vault-mcp-server@latest"
      ],
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

Paste under mcpServers. Fully quit and reopen Claude after editing.

CLI or .mcp.jsonshell

# export VAULT_ADDR=https://vault.example.com
# export VAULT_TOKEN=hvs.…
# export VAULT_NAMESPACE=admin (Enterprise only)
claude mcp add vault -- go install github.com/hashicorp/vault-mcp-server@latest

Run from your repo. Commit .mcp.json to share with your team.

.cursor/mcp.jsonjson

{
  "mcpServers": {
    "vault": {
      "command": "go",
      "args": [
        "install",
        "github.com/hashicorp/vault-mcp-server@latest"
      ],
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

Global path: ~/.cursor/mcp.json. Reload window after editing.

.vscode/mcp.jsonjsonc

{
  "servers": {
    "vault": {
      "command": "go",
      "args": [
        "install",
        "github.com/hashicorp/vault-mcp-server@latest"
      ],
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

VS Code uses the "servers" key (not "mcpServers").

~/.codeium/windsurf/mcp_config.jsonjson

{
  "mcpServers": {
    "vault": {
      "command": "go",
      "args": [
        "install",
        "github.com/hashicorp/vault-mcp-server@latest"
      ],
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

Open via Cascade → hammer icon → Configure.

cline_mcp_settings.jsonjson

{
  "mcpServers": {
    "vault": {
      "command": "go",
      "args": [
        "install",
        "github.com/hashicorp/vault-mcp-server@latest"
      ],
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

Open via the Cline sidebar → MCP Servers → Edit.

~/.continue/config.jsonjson

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "go",
          "args": [
            "install",
            "github.com/hashicorp/vault-mcp-server@latest"
          ],
          "env": {
            "VAULT_ADDR": "${VAULT_ADDR}",
            "VAULT_TOKEN": "${VAULT_TOKEN}",
            "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
          }
        }
      }
    ]
  }
}

Continue uses modelContextProtocolServers with a transport block.

~/.codex/config.tomlshell

# ~/.codex/config.toml
[mcp_servers.vault]
command = "go"
args = [
  "install",
  "github.com/hashicorp/vault-mcp-server@latest",
]
env = { VAULT_ADDR = "${VAULT_ADDR}", VAULT_TOKEN = "${VAULT_TOKEN}", VAULT_NAMESPACE = "${VAULT_NAMESPACE}" }

Codex uses TOML. Each server is a [mcp_servers.<name>] subtable.

~/.config/zed/settings.jsonjsonc

{
  "context_servers": {
    "vault": {
      "command": {
        "path": "go",
        "args": [
          "install",
          "github.com/hashicorp/vault-mcp-server@latest"
        ]
      },
      "env": {
        "VAULT_ADDR": "${VAULT_ADDR}",
        "VAULT_TOKEN": "${VAULT_TOKEN}",
        "VAULT_NAMESPACE": "${VAULT_NAMESPACE}"
      }
    }
  }
}

Zed calls them "context_servers". Settings live-reload on save.

ChatGPT → Apps directorynone

HashiCorp Vault doesn't ship a hosted HTTPS endpoint today. ChatGPT supports remote MCP servers only — to use this server in ChatGPT you'll need to deploy it to a public HTTPS URL first (e.g. via Cloudflare Workers or Vercel) or wait for an official remote build.

2
Set required secrets
Set VAULT_ADDR, VAULT_TOKEN, VAULT_NAMESPACE in your shell environment before launching your MCP client.
3
Try a minimum working prompt
Minimum working prompt pending verification. Try any prompt from the MCP’s README once installed.

Tools & permissions

Tool	Description	Args	Side effects
`list_mounts`	List the secrets engines mounted on the Vault server.	—	Read
`create_mount`	Enable a secrets engine at a path.	—	Write
`delete_mount`	Disable a secrets engine.	—	Write
`list_secrets`	List the secrets under a KV path.	—	Read
`read_secret`	Read a secret from a KV mount.	—	Read
`write_secret`	Write a secret to a KV mount.	—	Write
`delete_secret`	Delete a secret from a KV mount.	—	Write
`enable_pki`	Enable a PKI secrets engine.	—	Write
`list_pki_issuers`	List the issuers configured on a PKI mount.	—	Read
`read_pki_issuer`	Read one PKI issuer.	—	Read
`create_pki_issuer`	Create a PKI issuer.	—	Write
`list_pki_roles`	List the roles on a PKI mount.	—	Read
`read_pki_role`	Read one PKI role.	—	Read
`create_pki_role`	Create a PKI role.	—	Write
`delete_pki_role`	Delete a PKI role.	—	Write
`issue_pki_certificate`	Issue a certificate from a PKI role.	—	Write

Security & scope

Access scope: Read-only
Sandbox: Vault token in env. All capability checks happen at the Vault side — the MCP is a thin client. Treat the token as a high-value credential and prefer short-lived tokens issued at session start.
Gotchas: A wildcard policy on the agent token defeats the entire purpose. Mint narrowly-scoped tokens, one per workflow.
write_secret and delete_secret are exposed alongside the read tools — a token with write policy lets an agent overwrite or destroy secrets, so scope the policy, not just the prompt.
Audit logs on the Vault side are your forensic trail. Make sure they are enabled and shipped off-host.

Agent prompt pack

— copy into Claude, Cursor, or ChatGPT.

Paste into Claude, Cursor, or ChatGPT. Edit the [brackets] before sending.

Recommend the best MCP servers for [task: e.g. security work] in [client: Claude].

Constraints:
- Prefer tools that are [official | open-source | read-only] — pick what matters for my use case.
- Exclude MCPs that require [e.g. a paid plan, OAuth-only flows, remote-only transport].
- Return at most 3 picks, ranked.

For each pick include:
1. One-sentence rationale.
2. The ready-to-paste install snippet for my client.
3. Any required secrets I need to create before installing.

Cross-check the top-mcps.com listing: https://top-mcps.com/top-mcps-for-security

Compare HashiCorp Vault against a real alternative. Swap the second MCP in [brackets] if you want a different match.

Compare HashiCorp Vault MCP vs [1Password MCP] for the following job: [describe the job, e.g. "let an agent create GitHub issues on bug triage"].

Judge them on:
- Setup time and complexity (what a new user hits first).
- Auth model (none / API key / OAuth 2.1) and credential risk.
- Transport (stdio / Streamable HTTP / SSE) and where the server runs.
- Required secrets and the blast radius if they leak.
- Operational risk in an unattended agent loop.
- Which one is "good enough" for a weekend prototype vs. production.

End with one sentence: which should I pick for my scenario, which is: [my scenario].

References:
- https://top-mcps.com/mcp/vault
- top-mcps.com listing for 1Password

Asks the agent to install and verify. Works inside Claude Code, Cursor Agent, Codex CLI.

Install the HashiCorp Vault MCP server for my [client: Claude] at the default config path for that client.

Use the exact install snippet published at https://top-mcps.com/mcp/vault (fetch https://top-mcps.com/mcp/vault.json for the canonical server.json if you can read URLs).

Before finishing:
1. Create the required secrets (VAULT_ADDR, VAULT_TOKEN, VAULT_NAMESPACE) and put them in the appropriate env block — do not hard-code them.
2. Restart or reload the client so it picks up the new server.
3. Verify the server is connected (green / running state) and at least one tool is listed.
4. If anything fails, read the client's MCP logs and report the exact error — do not silently retry.

Confirm when done and list the tools the server now exposes.

Frequently asked questions

What changed

— 2 updates tracked.

Aug 24, 2026
Refreshed install snippets and fact sheet; verified for 2026.
Mar 18, 2025
Initial directory listing.

At a glance

Maintainer: HashiCorp
Transport: stdio
Auth model: API key
Required secrets: VAULT_ADDRVAULT_TOKENVAULT_NAMESPACE
Supported clients: ChatGPT
Claude Desktop
Claude Code
Cursor
VS Code
Windsurf
Cline
Continue
Zed
Codex CLI
License: MPL-2.0
Language: Go
Latest version: latest
Last verified: Aug 24, 2026

GitHub repo

Rank badge

Maintainer of HashiCorp Vault? Embed the live badge — it re-renders with the current rank and score on every catalog refresh.

[![Ranked #5 in Security on Top-MCPs](https://top-mcps.com/badge/vault.svg)](https://top-mcps.com/mcp/vault)

Alternatives

1Password →
Inject 1Password secrets into an AI agent's tool calls without exposing them in chat.
Doppler →
Inject secrets from Doppler into agent workflows without exposing values in chat.

Related guides

Best MCPs for Security in 2026 (Ranked + Posture Workflows) →
Vertical Guide
MCP Security: What to Know Before You Install →
Security
Least-Privilege Scoping for MCPs: How to Grant the Smallest Useful Permission →
Security

More Security MCPs

Other tools in the same category worth evaluating.

Sentry

Official

Triage errors, inspect traces, and query events from Sentry.

sentryerrorsmonitoringobservability

3 minLow

Cloudflare

Official

Reach the whole Cloudflare API from an agent — DNS records, Workers, R2, and the Registrar beta — through one hosted Code Mode server.

cloudflareedgeworkersdns

5 minMedium

1Password

Official

Inject 1Password secrets into an AI agent's tool calls without exposing them in chat.

securitysecrets1passwordvault

8 minLow

Compared with HashiCorp Vault

Side-by-side breakdowns for the choices people most often weigh against this MCP.

HashiCorp Vaultvs1Password HashiCorp VaultvsDoppler

Exploring Top MCPs for Security? See all Security MCPs →

Quick answer

What it does

Best for

Not for

Setup recipe

Install

Set required secrets

Try a minimum working prompt

Tools & permissions

Security & scope

Agent prompt pack

Full details

Frequently asked questions

How is the agent token scoped?

Can it issue dynamic database credentials?

Namespaces?

Approle / AWS auth instead of token?

What changed

More Security MCPs

Sentry

Cloudflare

1Password

Compared with HashiCorp Vault