H
hashicorp/vault-mcp-server
Read secrets and manage HashiCorp Vault policies via MCP
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"hashicorp-vault-mcp-server": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector"]
}
}
}Parsed from the README we fetched on 2026-11-07; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"hashicorp-vault-mcp-server": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio hashicorp-vault-mcp-server -- npx @modelcontextprotocol/inspector
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Source
- collected from the abordage/awesome-mcp list · type: MCP server
- Harvest history
- first seen 2026-11-05 · last seen 2026-11-14 · seen 10× · listed by 10 sources
- Score
- score 1,003 · 10 sources · mcp
- Install
npx @modelcontextprotocol/inspector
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx @modelcontextprotocol/inspector. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: MCP 服务. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
first catalogued 2026-11-05；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.
# Vault MCP Server
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
The Vault MCP Server is a Model Context Protocol (MCP)
server implementation that provides integration with HashiCorp
Vault for managing secrets and mounts. This server uses both stdio and StreamableHTTP
transports for MCP communication, making it compatible with Claude for Desktop
and other MCP clients.
> Security Note: At this stage, the MCP server is intended for local use only. The MCP server should only be deployed in trusted networks with trusted clients. If using the StreamableHTTP transport, always configure the MCP_ALLOWED_ORIGINS environment variable to restrict access to trusted browser origins only. This helps prevent DNS rebinding attacks and other cross-origin browser attacks. MCP_ALLOWED_ORIGINS is a CORS protection and not a network connection allowlist.
> Security Note: Depending on the query, the MCP server may expose certain Vault data, including Vault secrets, to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.
> Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.
> Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.
## Features
Create new mounts in Vault (KV v1, KV v2)
List all available mounts
Delete a mount
Write secrets to KV mounts
Read secrets from KV mounts
List all secrets under a path
Delete a complete secret or a key of a secret
Comprehensive HTTP middleware stack (CORS, logging, Vault context)
Session-based Vault client management
Structured logging with configurable output
## Prerequisites
Go 1.24 or later (if building from source)
Docker
HashiCorp Vault server running locally or remotely
A valid Vault token with appropriate permissions
## Setup
1. Clone the repository:
bash
git clone https://github.com/hashicorp/vault-mcp-server.git
cd vault-mcp-server
2. Build the binary:
bash
make build
3. Run the server:
Stdio mode (default):
bash
./vault-mcp-server
# or explicitly
./vault-mcp-server stdio
HTTP mode:
bash
./vault-mcp-server http --transport-port 8080
# or using make
make run-http
## Environment Variables
The server can be configured using environment variables:
VAULT_ADDR: Vault server address (default: http://127.0.0.1:8200)
VAULT_TOKEN: Vault authentication token (required)
VAULT_NAMESPACE: Vault namespace (optional)
TRANSPORT_MODE: Set to http to enable HTTP mode
TRANSPORT_HOST: Host to bind to for HTTP mode (default: 127.0.0.1)
TRANSPORT_PORT: Port for HTTP mode (default: 8080)
MCP_ENDPOINT: HTTP server endpoint path (default: /mcp)
MCP_ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS (default: "")
server implementation that provides integration with HashiCorp
Vault for managing secrets and mounts. This server uses both stdio and StreamableHTTP
transports for MCP communication, making it compatible with Claude for Desktop
and other MCP clients.
> Security Note: At this stage, the MCP server is intended for local use only. The MCP server should only be deployed in trusted networks with trusted clients. If using the StreamableHTTP transport, always configure the MCP_ALLOWED_ORIGINS environment variable to restrict access to trusted browser origins only. This helps prevent DNS rebinding attacks and other cross-origin browser attacks. MCP_ALLOWED_ORIGINS is a CORS protection and not a network connection allowlist.
> Security Note: Depending on the query, the MCP server may expose certain Vault data, including Vault secrets, to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.
> Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.
> Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.
## Features
Create new mounts in Vault (KV v1, KV v2)
List all available mounts
Delete a mount
Write secrets to KV mounts
Read secrets from KV mounts
List all secrets under a path
Delete a complete secret or a key of a secret
Comprehensive HTTP middleware stack (CORS, logging, Vault context)
Session-based Vault client management
Structured logging with configurable output
## Prerequisites
Go 1.24 or later (if building from source)
Docker
HashiCorp Vault server running locally or remotely
A valid Vault token with appropriate permissions
## Setup
1. Clone the repository:
bash
git clone https://github.com/hashicorp/vault-mcp-server.git
cd vault-mcp-server
2. Build the binary:
bash
make build
3. Run the server:
Stdio mode (default):
bash
./vault-mcp-server
# or explicitly
./vault-mcp-server stdio
HTTP mode:
bash
./vault-mcp-server http --transport-port 8080
# or using make
make run-http
## Environment Variables
The server can be configured using environment variables:
VAULT_ADDR: Vault server address (default: http://127.0.0.1:8200)
VAULT_TOKEN: Vault authentication token (required)
VAULT_NAMESPACE: Vault namespace (optional)
TRANSPORT_MODE: Set to http to enable HTTP mode
TRANSPORT_HOST: Host to bind to for HTTP mode (default: 127.0.0.1)
TRANSPORT_PORT: Port for HTTP mode (default: 8080)
MCP_ENDPOINT: HTTP server endpoint path (default: /mcp)
MCP_ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS (default: "")
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/hashicorp-vault-mcp-server/)
- Source
- awesome · https://github.com/hashicorp/vault-mcp-server
- Browse by field
- MCP servers
- Listed by
- 10 independent sources
- added
- today
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.