H
hashicorp/vault-mcp-server
Read secrets and manage HashiCorp Vault policies via MCP
在 GitHub 查看 ↗链接已于 2026-11-12 核查 · HTTP 200 · 打开的是厂商自己的官网
安装与配置
客户端配置（取自该仓库的安装命令）
{
"mcpServers": {
"hashicorp-vault-mcp-server": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector"]
}
}
}解析自我们于 2026-11-07 抓取的该仓库 README；我们未执行过。
command/args 来自仓库写明的安装命令；不确定时请以该项目 README 为准。
VS Code（.vscode/mcp.json —— 键名是 servers）
{
"servers": {
"hashicorp-vault-mcp-server": {
"command": "npx",
"args": ["@modelcontextprotocol/inspector"]
}
}
}VS Code 顶层键是 <code>servers</code>，其余与上面那份相同。
Claude Code（命令行）
claude mcp add --transport stdio hashicorp-vault-mcp-server -- npx @modelcontextprotocol/inspector
Claude Code 不收 JSON 文件，用这条命令直接加。
配置项的键名以你的客户端为准：客户端与 CLI
- 来源明细
- 收录自 abordage/awesome-mcp 榜单（我们从中收集的条目之一） · 条目类型：MCP 服务
- 收录与活跃
- 收录于 2026-11-05 · 最近见到 2026-11-14 · 共见到 10 次 · 被 10 个来源列出
- 评分构成
- 综合分 1,003 · 10 个来源 · mcp
- 安装
npx @modelcontextprotocol/inspector
常见问题（答案都来自我们的记录）
怎么安装？
该仓库给出的安装命令是
npx @modelcontextprotocol/inspector。我们的记录里它是仓库自己提供的；不保证在你的客户端上直接可用。它适合谁 / 用来做什么？
我们把它归在这些标签下: MCP 服务。标签来自条目自身，不是我们强加的分类。
谁维护它、还在更新吗？
我们收录于 2026-11-05；最近见到 2026-11-14。这里没有"官方认证"或"质量评级"——我们只记录来源与时间。
# Vault MCP Server
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
The Vault MCP Server is a Model Context Protocol (MCP)
server implementation that provides integration with HashiCorp
Vault for managing secrets and mounts. This server uses both stdio and StreamableHTTP
transports for MCP communication, making it compatible with Claude for Desktop
and other MCP clients.
> Security Note: At this stage, the MCP server is intended for local use only. The MCP server should only be deployed in trusted networks with trusted clients. If using the StreamableHTTP transport, always configure the MCP_ALLOWED_ORIGINS environment variable to restrict access to trusted browser origins only. This helps prevent DNS rebinding attacks and other cross-origin browser attacks. MCP_ALLOWED_ORIGINS is a CORS protection and not a network connection allowlist.
> Security Note: Depending on the query, the MCP server may expose certain Vault data, including Vault secrets, to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.
> Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.
> Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.
## Features
Create new mounts in Vault (KV v1, KV v2)
List all available mounts
Delete a mount
Write secrets to KV mounts
Read secrets from KV mounts
List all secrets under a path
Delete a complete secret or a key of a secret
Comprehensive HTTP middleware stack (CORS, logging, Vault context)
Session-based Vault client management
Structured logging with configurable output
## Prerequisites
Go 1.24 or later (if building from source)
Docker
HashiCorp Vault server running locally or remotely
A valid Vault token with appropriate permissions
## Setup
1. Clone the repository:
bash
git clone https://github.com/hashicorp/vault-mcp-server.git
cd vault-mcp-server
2. Build the binary:
bash
make build
3. Run the server:
Stdio mode (default):
bash
./vault-mcp-server
# or explicitly
./vault-mcp-server stdio
HTTP mode:
bash
./vault-mcp-server http --transport-port 8080
# or using make
make run-http
## Environment Variables
The server can be configured using environment variables:
VAULT_ADDR: Vault server address (default: http://127.0.0.1:8200)
VAULT_TOKEN: Vault authentication token (required)
VAULT_NAMESPACE: Vault namespace (optional)
TRANSPORT_MODE: Set to http to enable HTTP mode
TRANSPORT_HOST: Host to bind to for HTTP mode (default: 127.0.0.1)
TRANSPORT_PORT: Port for HTTP mode (default: 8080)
MCP_ENDPOINT: HTTP server endpoint path (default: /mcp)
MCP_ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS (default: "")
server implementation that provides integration with HashiCorp
Vault for managing secrets and mounts. This server uses both stdio and StreamableHTTP
transports for MCP communication, making it compatible with Claude for Desktop
and other MCP clients.
> Security Note: At this stage, the MCP server is intended for local use only. The MCP server should only be deployed in trusted networks with trusted clients. If using the StreamableHTTP transport, always configure the MCP_ALLOWED_ORIGINS environment variable to restrict access to trusted browser origins only. This helps prevent DNS rebinding attacks and other cross-origin browser attacks. MCP_ALLOWED_ORIGINS is a CORS protection and not a network connection allowlist.
> Security Note: Depending on the query, the MCP server may expose certain Vault data, including Vault secrets, to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.
> Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.
> Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.
## Features
Create new mounts in Vault (KV v1, KV v2)
List all available mounts
Delete a mount
Write secrets to KV mounts
Read secrets from KV mounts
List all secrets under a path
Delete a complete secret or a key of a secret
Comprehensive HTTP middleware stack (CORS, logging, Vault context)
Session-based Vault client management
Structured logging with configurable output
## Prerequisites
Go 1.24 or later (if building from source)
Docker
HashiCorp Vault server running locally or remotely
A valid Vault token with appropriate permissions
## Setup
1. Clone the repository:
bash
git clone https://github.com/hashicorp/vault-mcp-server.git
cd vault-mcp-server
2. Build the binary:
bash
make build
3. Run the server:
Stdio mode (default):
bash
./vault-mcp-server
# or explicitly
./vault-mcp-server stdio
HTTP mode:
bash
./vault-mcp-server http --transport-port 8080
# or using make
make run-http
## Environment Variables
The server can be configured using environment variables:
VAULT_ADDR: Vault server address (default: http://127.0.0.1:8200)
VAULT_TOKEN: Vault authentication token (required)
VAULT_NAMESPACE: Vault namespace (optional)
TRANSPORT_MODE: Set to http to enable HTTP mode
TRANSPORT_HOST: Host to bind to for HTTP mode (default: 127.0.0.1)
TRANSPORT_PORT: Port for HTTP mode (default: 8080)
MCP_ENDPOINT: HTTP server endpoint path (default: /mcp)
MCP_ALLOWED_ORIGINS: Comma-separated list of allowed origins for CORS (default: "")
收录徽章（可选）
想把收录标记放进 README 就复制这行，可选，不影响收录。
[](https://anclum.com/zh/s/hashicorp-vault-mcp-server/)
- 来源
- awesome · https://github.com/hashicorp/vault-mcp-server
- 按领域浏览
- MCP 服务
- 收录来源
- 10 个独立来源
- 收录于
- 今天
同类推荐
所属领域与标签
每个标签都能点进去看同类的全部条目。数字是当前库里的真实条数。