HashiCorp Vault MCP Server

A Model Context Protocol (MCP) server that provides tools for interacting with HashiCorp Vault via Streamable HTTP API.

Features

This MCP server provides the following tools for Vault operations:

• vault_read: Read secrets from Vault at a specified path

• vault_write: Write secrets to Vault at a specified path

• vault_list: List secrets at a specified path

• vault_delete: Delete secrets from Vault at a specified path

Installation

Prerequisites

This server uses the hashi-vault-js library to communicate with HashiCorp Vault. Make sure you have:

• Node.js 18 or later

• A running HashiCorp Vault server

• A valid Vault authentication token

Configuration

The server requires the following environment variables:

• VAULT_ADDR: The address of your Vault server (default: http://127.0.0.1:8200)

• VAULT_TOKEN: Your Vault authentication token

• MCP_PORT: The port for the MCP server API (default: 3000)

Usage

Running the Server

The server will start and expose the following endpoints:

• http://localhost:3000/health - Health check endpoint

• http://localhost:3000/sse - SSE endpoint for MCP client connections

• http://localhost:3000/message - Message endpoint for client requests

Using with Gemini CLI

Add this configuration to your Gemini config file:

MacOS: ~/.gemini/settings.json

Note: Make sure the server is running before starting Claude Desktop.

Using with MCP Clients

Connect to the SSE endpoint at http://localhost:3000/mcp using any MCP-compatible client. The server uses Server-Sent Events (SSE) for real-time communication.

Tool Examples

Reading a Secret

Writing a Secret

Listing Secrets

Deleting a Secret

Development

Build

Watch Mode

Vault Setup

For testing, you can run Vault in dev mode:

This will start Vault at http://127.0.0.1:8200 with a root token displayed in the output.

Security Notes

• Never commit your VAULT_TOKEN to version control

• Use appropriate Vault policies to restrict access

• Consider using AppRole or other authentication methods for production

• Ensure your Vault server uses TLS in production environments

License

MIT