Which integrations are available for this server?

Provides tools for reading secrets and metadata from HashiCorp Vault KV secrets engine, including listing paths, reading secret versions, and checking server health.

How do I use vault-kv-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@vault-kv-mcp read the secret at path secret/demo" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

vault-kv-mcp

by elisjetmax

Overview Schema Source Related Servers Discussions Admin

JavaScript

Local

vault-kv-mcp

A read-only MCP (Model Context Protocol) server that exposes the HashiCorp Vault KV secrets engine (versions 1 and 2) as tools. Every tool performs only non-destructive reads — there are no write, delete, or destroy operations. It authenticates with a Vault token and speaks MCP over stdio, so it works with local MCP clients such as Claude Desktop.

Tools (all read-only)

Tool	Description
`vault_kv_read`	Read a secret (latest or a specific KV v2 version).
`vault_kv_list`	List keys / sub-folders under a path.
`vault_kv_read_metadata`	KV v2: read version history and metadata.
`vault_list_kv_mounts`	Discover available secret mounts and their KV versions.
`vault_health`	Check Vault server health / connectivity.

KV v1 vs v2 is auto-detected per mount when kv_version is not supplied (falling back to v2).

For defense in depth, pair this with a Vault token whose policies grant only read/list capabilities on the relevant paths.

Related MCP server: Vault MCP Server (mschuchard)

Configuration

Set these environment variables (see .env.example):

VAULT_ADDR — Vault base URL (default http://127.0.0.1:8200)
VAULT_TOKEN — required Vault token, sent as the X-Vault-Token header
VAULT_NAMESPACE — optional, for Vault Enterprise / HCP Vault
VAULT_SKIP_VERIFY — optional, set true to skip TLS verification (dev only)

The token only needs policies granting access to the KV paths you intend to use.

Build

npm install
npm run build

Run / test with the MCP Inspector

VAULT_ADDR=http://127.0.0.1:8200 VAULT_TOKEN=hvs.xxxx npm run inspector

Use with Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "vault-kv": {
      "command": "node",
      "args": ["/absolute/path/to/vault-mcp/dist/index.js"],
      "env": {
        "VAULT_ADDR": "http://127.0.0.1:8200",
        "VAULT_TOKEN": "hvs.your-token-here"
      }
    }
  }
}

Quick local Vault for testing

vault server -dev          # prints a Root Token and unseal info
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=<root-token-from-output>
vault kv put secret/demo username=app password=s3cr3t

Then ask your MCP client to read secret/demo.

Security notes

The server only ever reads from Vault; it never writes, deletes, or destroys secrets.
The token is read only from the environment and never logged.
Prefer a short-lived, least-privilege token (read/list only) over a root token.

Available Tools

5 tools

vault_healthVault server healthA

Read-onlyIdempotent

Check the Vault server's health: whether it is initialized, sealed, and in standby. Good for verifying connectivity and configuration.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`initialized`	No
`sealed`	No
`standby`	No
`version`	No

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, non-destructive, idempotent. Description adds specific health checks (init, seal, standby), enhancing transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with purpose. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool is simple with 0 parameters and output schema present. Description is complete for its function.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so baseline 4 applies. Description need not add param info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks Vault server health, specifying initialized, sealed, and standby status. It distinguishes from sibling KV tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says 'Good for verifying connectivity and configuration,' providing clear context. No exclusions needed as siblings are unrelated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_kv_listList KV keysA

Read-onlyIdempotent

List the secret keys/sub-folders under a path. Keys ending in '/' are sub-folders. Use path '' or '/' to list the root of the mount.

ParametersJSON Schema

Name	Required	Description
`mount`	Yes	Mount point of the KV secrets engine, without leading/trailing slashes (e.g. 'secret', 'kv', 'apps/prod').
`path`	No	Folder path to list within the mount. Omit or use '' to list the mount root.
`kv_version`	No	KV engine version: 1 or 2. If omitted, the server auto-detects it from the mount (falling back to 2). Set explicitly to avoid an extra detection call.

Output Schema

ParametersJSON Schema

Name	Required	Description
`keys`	Yes	Secret names and sub-folders (sub-folders end with '/').
`kv_version`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, destructiveHint, idempotentHint. The description adds behavioral context: keys ending in '/' are sub-folders, and kv_version auto-detection can be bypassed. This adds value beyond annotations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences that are front-loaded and free of fluff. First sentence states exact purpose, second sentence adds key nuance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With all parameters documented in schema, behavioral details provided, and an output schema present, the description covers everything needed for an agent to correctly invoke this tool. No gaps identified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds extra meaning: explains path behavior for root listing and kv_version's performance benefit. This enriches understanding of parameters beyond schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists secret keys/sub-folders under a path, with a specific verb and resource. It distinguishes from siblings like vault_kv_read and vault_kv_read_metadata by focusing on listing versus reading. Additional details (keys ending in '/') add clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to list the root using path '' or '/', providing clear usage context. However, it does not explicitly state when not to use this tool or name alternatives, though sibling tool names are provided in context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_kv_readRead a KV secretA

Read-onlyIdempotent

Read the key/value data stored at a secret path in a Vault KV engine. For KV v2 you may request a specific historical version; omit it to get the latest.

ParametersJSON Schema

Name	Required	Description
`mount`	Yes	Mount point of the KV secrets engine, without leading/trailing slashes (e.g. 'secret', 'kv', 'apps/prod').
`path`	Yes	Path of the secret within the mount (e.g. 'db/creds', 'services/api'). Do NOT include the mount, or the KV v2 'data/'/'metadata/' prefix — those are added automatically.
`kv_version`	No	KV engine version: 1 or 2. If omitted, the server auto-detects it from the mount (falling back to 2). Set explicitly to avoid an extra detection call.
`version`	No	KV v2 only: specific secret version number to read. Omit for the latest version.

Output Schema

ParametersJSON Schema

Name	Required	Description
`data`	Yes	The secret's key/value pairs.
`metadata`	No	KV v2 version metadata (version, created_time, etc.).
`kv_version`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. The description adds behavioral context beyond annotations: versioning support for KV v2, and auto-detection of kv_version. No contradictions. Minor missing details like error handling or auth requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose. Every sentence adds value with no fluff. Highly concise and clear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present (not shown but indicated), explanation of return values is unnecessary. The description covers versioning, mount/path format, and kv_version auto-detection. Missing error behavior but acceptable for a read operation. Completeness is high given available context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds value by explaining version parameter semantics ('specific historical version; omit for latest') and clarifying mount/path formatting. This extra context justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Read') and resource ('key/value data stored at a secret path in a Vault KV engine'). It distinguishes between KV v1 and v2 regarding version, and the tool is distinct from siblings like vault_kv_list and vault_kv_read_metadata.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the version parameter for KV v2 but does not explicitly guide the agent on when to choose this tool over siblings (e.g., vault_kv_read_metadata for metadata, vault_kv_list for listing). Implicit context is provided but no clear when-not or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_kv_read_metadataRead KV v2 secret metadataA

Read-onlyIdempotent

KV v2 only: read metadata for a secret, including the full version history, current version, created/updated times, and custom_metadata.

ParametersJSON Schema

Name	Required	Description	Default
`mount`	Yes	Mount point of the KV secrets engine, without leading/trailing slashes (e.g. 'secret', 'kv', 'apps/prod').
`path`	Yes	Path of the secret within the mount (e.g. 'db/creds', 'services/api'). Do NOT include the mount, or the KV v2 'data/'/'metadata/' prefix — those are added automatically.

Output Schema

ParametersJSON Schema

Name	Required	Description
`metadata`	Yes	Metadata object including versions, current_version, created_time, custom_metadata.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the description's job is to add context. It does so by listing what metadata is returned (version history, times, custom_metadata), providing behavioral detail beyond the annotations. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that is front-loaded with the critical 'KV v2 only' qualifier. Every word adds value; no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of sibling tools, annotations, and an output schema (which documents return values), the description covers the essential purpose, scope (KV v2 only), and included data. It does not mention error conditions or authentication, but those are likely standard for Vault tools. Overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already describes both parameters clearly. The description does not add additional parameter-level meaning beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads metadata for a secret in KV v2, listing specific data fields (version history, current version, timestamps, custom_metadata). It distinguishes from siblings like vault_kv_read (data) and vault_kv_list (listing paths) by emphasizing it's for metadata only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly limits usage to KV v2 ('KV v2 only'), which helps agents choose between this and vault_kv_read for data. However, it does not explicitly state when not to use or name alternatives, but the sibling context makes the distinction clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

vault_list_kv_mountsList KV secret mountsA

Read-onlyIdempotent

Discover the secret engine mounts available to the current token, including each KV mount's version. Useful to learn which 'mount' values to pass to the other tools.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`mounts`	Yes	Available secret mounts.

TDQS

A4.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide safety and idempotency info. Description adds that it returns KV mount versions, but no further behavioral traits beyond what annotations indicate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, immediately clear purpose, no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and clear annotations, description is complete. Output schema handles return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, and schema coverage is 100%. Description doesn't need to add parameter details; baseline 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it discovers secret engine mounts and their KV versions, differentiating from sibling tools that operate on specific paths or health checks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states utility: learn mount values for other tools. Implicitly when-not-to-use is not needed as it's a discovery tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

5 tool updatesv1.0.0Jun 24, 2026
- First observedvault_health
- First observedvault_kv_list
- First observedvault_kv_read
- First observedvault_kv_read_metadata
- First observedvault_list_kv_mounts

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.3/5.0

Scored 2026-06-24 16:20 across 5 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: health check, listing keys, reading secrets, reading metadata, and discovering mounts. No overlap or ambiguity.

Naming Consistency4/5

All tools follow the vault_ prefix and verb_noun pattern, but there is slight inconsistency in ordering (e.g., vault_kv_list vs vault_list_kv_mounts). Overall still predictable.

Tool Count5/5

Five tools is well-scoped for a Vault KV server, covering essential operations without bloat or missing necessary categories.

Completeness3/5

Missing write/update and delete operations for secrets, which are typical in KV management. The tools are read-heavy, leaving notable gaps for lifecycle management.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

thoughtsOAuth
ai.thoughtbox.api
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Cloud Storage Finance
2
The Quiet Protocol Growth Offense MCP A
com.thequietprotocol.www
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Databases Research & Data Finance
292
MANDATE Credential Broker B
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
SRI — MCP Server Inspector A
biz.sri-test
2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.
Developer Tools
21

Related MCP Servers

Vault MCP Server
Security Databases Developer Tools
kelleyblackmore
A
license
A
quality
D
maintenance
Enables interaction with HashiCorp Vault to read, write, list, and delete secrets through a containerized MCP server with secure token-based authentication.
Updated a year ago (2025-11-01 09:01 UTC)
4
3 npm
MIT
Vault MCP Server (mschuchard)
Security Databases Developer Tools
mschuchard
A
license
Not graded
quality
B
maintenance
A third-party MCP server for interacting with HashiCorp Vault to manage ACL policies, audit devices, and secret engines like KV v2, PKI, and Transit. It provides tools for system backend administration and includes prompts for generating security policy configurations.
Updated 3 days ago (2026-09-17 20:36 UTC)
MIT
wundervaultofficial
Security
wundervault
A
license
A
quality
A
maintenance
MCP server for Wundervault zero-knowledge secret management. Exposes vault secrets to AI agents via the Model Context Protocol — secrets are decrypted server-side and never returned to the agent in plaintext.
Updated 6 days ago (2026-09-14 14:30 UTC)
1
324 npm
2
AGPL 3.0
Terraform Cloud MCP
Cloud Platforms CI/CD & DevOps
Jackdaw16
A
license
Not graded
quality
B
maintenance
A read-only MCP server for inspecting and diagnosing HCP Terraform workspaces, runs, and plan summaries from ChatGPT and other MCP clients. It provides tools to list workspaces, inspect runs, and summarize plans without exposing sensitive data.
Updated a month ago (2026-08-25 18:49 UTC)
MIT

vault-kv-mcp

Tools (all read-only)

Configuration

Build

Run / test with the MCP Inspector

Use with Claude Desktop

Quick local Vault for testing

Security notes

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

wundervaultofficial