dokploy-mcp-server

dokploy_vault_provider

Manage external secret-manager vault providers in Dokploy: list, create, update, test connections, and discover secret names across HashiCorp, AWS, Azure, and more.

Instructions

External secret-manager (vault) configuration. list, get (vaultProviderId), create (name+config+assignments), update (vaultProviderId+name+config+assignments — the API REPLACES the provider, so all four must be sent even when changing one; run get first), remove (vaultProviderId), testConnection (vaultProviderId for a saved provider, or config to check credentials before saving), listSecretNames (vaultProviderId+projectId, environmentId?). config is discriminated on providerType: hashicorp | infisical | aws | aws-parameter-store | doppler | azure | scaleway | phase. Note infisical.projectId and scaleway.projectId are that provider's own project, NOT the Dokploy projectId used in assignments. assignments is [{projectId, environmentIds?}] naming the Dokploy projects the vault serves. listSecretNames returns names only — Dokploy exposes no API to read a secret's value — and provider credentials are never echoed back in tool output.

Input Schema

TableJSON Schema

Name	Required	Description
`name`	No	Provider name (letters, digits, _ and - only)
`action`	Yes
`config`	No	Vault credentials, keyed by providerType
`projectId`	No	listSecretNames: Dokploy project ID
`assignments`	No	Dokploy projects/environments this vault serves
`environmentId`	No	listSecretNames: narrow to one environment
`vaultProviderId`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv1.10.0Oct 3, 2026

changedInput schema / properties / config / oneOf

Previous value: -[
-  {
-    "properties": {
-      "mount": {
-        "description": "defaults to 'secret'",
-        "minLength": 1,
-        "type": "string"
-      },
-      "namespace": {
-        "type": "string"
-      },
-      "providerType": {
-        "const": "hashicorp",
-        "type": "string"
-      },
-      "token": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "url": {
-        "format": "uri",
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "url",
-      "token"
-    ],
-    "type": "object"
-  },
-  {
-    "properties": {
-      "clientId": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "clientSecret": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "environmentSlug": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "projectId": {
-        "description": "the Infisical project, not a Dokploy projectId",
-        "minLength": 1,
-        "type": "string"
-      },
-      "providerType": {
-        "const": "infisical",
-        "type": "string"
-      },
-      "secretPath": {
-        "description": "defaults to '/'",
-        "type": "string"
-      },
-      "siteUrl": {
-        "description": "defaults to https://app.infisical.com",
-        "format": "uri",
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "clientId",
-      "clientSecret",
-      "projectId",
-      "environmentSlug"
-    ],
-    "type": "object"
-  },
-  {
-    "properties": {
-      "accessKeyId": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "endpoint": {
-        "format": "uri",
-        "type": "string"
-      },
-      "providerType": {
-        "const": "aws",
-        "type": "string"
-      },
-      "region": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "secretAccessKey": {
-        "minLength": 1,
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "region",
-      "accessKeyId",
-      "secretAccessKey"
-    ],
-    "type": "object"
-  },
-  {
-    "properties": {
-      "config": {
-        "description": "Doppler config name, e.g. 'prod'",
-        "type": "string"
-      },
-      "project": {
-        "type": "string"
-      },
-      "providerType": {
-        "const": "doppler",
-        "type": "string"
-      },
-      "serviceToken": {
-        "minLength": 1,
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "serviceToken"
-    ],
-    "type": "object"
-  },
-  {
-    "properties": {
-      "clientId": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "clientSecret": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "providerType": {
-        "const": "azure",
-        "type": "string"
-      },
-      "tenantId": {
-        "minLength": 1,
-        "type": "string"
-      },
-      "vaultUri": {
-        "format": "uri",
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "vaultUri",
-      "tenantId",
-      "clientId",
-      "clientSecret"
-    ],
-    "type": "object"
-  },
-  {
-    "properties": {
-      "apiUrl": {
-        "description": "defaults to https://api.scaleway.com",
-        "format": "uri",
-        "type": "string"
-      },
-      "projectId": {
-        "description": "the Scaleway project, not a Dokploy projectId",
-        "minLength": 1,
-        "type": "string"
-      },
-      "providerType": {
-        "const": "scaleway",
-        "type": "string"
-      },
-      "region": {
-        "description": "defaults to 'fr-par'",
-        "type": "string"
-      },
-      "secretKey": {
-        "minLength": 1,
-        "type": "string"
-      }
-    },
-    "required": [
-      "providerType",
-      "projectId",
-      "secretKey"
-    ],
-    "type": "object"
-  }
-]New value: +[
+  {
+    "properties": {
+      "mount": {
+        "description": "defaults to 'secret'",
+        "minLength": 1,
+        "type": "string"
+      },
+      "namespace": {
+        "type": "string"
+      },
+      "providerType": {
+        "const": "hashicorp",
+        "type": "string"
+      },
+      "token": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "url": {
+        "format": "uri",
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "url",
+      "token"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "clientId": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "clientSecret": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "environmentSlug": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "projectId": {
+        "description": "the Infisical project, not a Dokploy projectId",
+        "minLength": 1,
+        "type": "string"
+      },
+      "providerType": {
+        "const": "infisical",
+        "type": "string"
+      },
+      "secretPath": {
+        "description": "defaults to '/'",
+        "type": "string"
+      },
+      "siteUrl": {
+        "description": "defaults to https://app.infisical.com",
+        "format": "uri",
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "clientId",
+      "clientSecret",
+      "projectId",
+      "environmentSlug"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "accessKeyId": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "endpoint": {
+        "format": "uri",
+        "type": "string"
+      },
+      "providerType": {
+        "const": "aws",
+        "type": "string"
+      },
+      "region": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "secretAccessKey": {
+        "minLength": 1,
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "region",
+      "accessKeyId",
+      "secretAccessKey"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "accessKeyId": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "endpoint": {
+        "format": "uri",
+        "type": "string"
+      },
+      "parameterPath": {
+        "description": "parameter discovery path, e.g. '/myapp/prod'",
+        "type": "string"
+      },
+      "providerType": {
+        "const": "aws-parameter-store",
+        "type": "string"
+      },
+      "region": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "secretAccessKey": {
+        "minLength": 1,
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "region",
+      "accessKeyId",
+      "secretAccessKey"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "config": {
+        "description": "Doppler config name, e.g. 'prod'",
+        "type": "string"
+      },
+      "project": {
+        "type": "string"
+      },
+      "providerType": {
+        "const": "doppler",
+        "type": "string"
+      },
+      "serviceToken": {
+        "minLength": 1,
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "serviceToken"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "clientId": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "clientSecret": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "providerType": {
+        "const": "azure",
+        "type": "string"
+      },
+      "tenantId": {
+        "minLength": 1,
+        "type": "string"
+      },
+      "vaultUri": {
+        "format": "uri",
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "vaultUri",
+      "tenantId",
+      "clientId",
+      "clientSecret"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "apiUrl": {
+        "description": "defaults to https://api.scaleway.com",
+        "format": "uri",
+        "type": "string"
+      },
+      "projectId": {
+        "description": "the Scaleway project, not a Dokploy projectId",
+        "minLength": 1,
+        "type": "string"
+      },
+      "providerType": {
+        "const": "scaleway",
+        "type": "string"
+      },
+      "region": {
+        "description": "defaults to 'fr-par'",
+        "type": "string"
+      },
+      "secretKey": {
+        "minLength": 1,
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "projectId",
+      "secretKey"
+    ],
+    "type": "object"
+  },
+  {
+    "properties": {
+      "apiUrl": {
+        "description": "defaults to https://api.phase.dev",
+        "format": "uri",
+        "type": "string"
+      },
+      "appId": {
+        "description": "the Phase app ID",
+        "minLength": 1,
+        "type": "string"
+      },
+      "env": {
+        "description": "Phase environment name, e.g. 'production'",
+        "minLength": 1,
+        "type": "string"
+      },
+      "path": {
+        "description": "defaults to '/'",
+        "type": "string"
+      },
+      "providerType": {
+        "const": "phase",
+        "type": "string"
+      },
+      "token": {
+        "minLength": 1,
+        "type": "string"
+      }
+    },
+    "required": [
+      "providerType",
+      "token",
+      "appId",
+      "env"
+    ],
+    "type": "object"
+  }
+]

Addedv1.9.1Aug 26, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that update REPLACES the provider (all four fields required even for a one-field change), that listSecretNames returns names only because no API reads values, and that provider credentials are never echoed back. Missing pieces are auth/permission requirements and rate-limit behavior, which keeps it out of the top band.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense, front-loaded paragraph that opens with purpose and then walks the action list; nearly every clause carries information (defaults, caveats, disambiguation) rather than filler. It loses a point for being a single unbroken run-on block that is harder to scan than a short action-per-line structure would be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, 7-action tool with no annotations and no output schema, the description covers the essentials: action semantics, required fields per action, config discrimination, and return-value behavior for listSecretNames. Remaining gaps (permission scopes, exact list/get payload shape) are modest given the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, and the description compensates well beyond it: it maps parameters to each action, documents the assignments shape ([{projectId, environmentIds?}]), and warns that infisical.projectId and scaleway.projectId are the provider's own project, not the Dokploy projectId. This cross-field disambiguation is genuine added meaning the schema only partially conveys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource precisely (external secret-manager / vault configuration) and enumerates the exact operations it supports (list, get, create, update, remove, testConnection, listSecretNames) with the key parameter for each. This cleanly distinguishes it from every sibling dokploy_* tool, none of which deal with vault providers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives actionable routing guidance within the multi-action tool: testConnection takes a vaultProviderId for a saved provider or a raw config to validate credentials before saving, and update explicitly says 'run get first' because the API replaces the provider. What it lacks is any statement of when not to use this tool versus a sibling, but given no sibling overlaps the domain, the intra-tool guidance is the valuable part and it is present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

dokploy_vault_provider

Instructions

Input Schema

Schema Changelog

TDQS

Other Tools