Labsco
MCP SERVER

Vault MCP Server

by mschuchard ↗

Third-party HashiCorp Vault server covering the system backend and five secrets engines, runnable locally as a container.

Identity, Access, Secrets & Encryption
Summary
The author tells you where not to use it.

Since HashiCorp shipped an official server, this one dropped formal releases, versioning and a changelog, and the README says plainly that it is not recommended for enterprise production. What it still offers is local execution as a container against your own cluster, a wider reach than a read-only view, and the diagnostic prompt that audits a Vault configuration and reports what looks wrong. Treat it as a lab and troubleshooting tool that holds real credentials, and scope the auth role accordingly.

What it is

An independent Vault server that can run locally as a container image rather than only remotely. It reaches across the system backend — ACL policies, audit devices, authentication engines, Raft clustering and snapshots, secrets engines — and into the secrets backends for KV Version 2, PKI, Transit, Identity/Alias and Database. HashiCorp now publishes an official Vault MCP server; the author states this one keeps being maintained but does not try to compete with it.

What you get
  • Tools (138) across the system backend and the Secrets backend — KV Version 2, PKI, Transit, Identity/Alias and Database
  • Resources (5) reporting current ACL policies, audit devices, authentication engines, secret engines and Raft cluster configuration
  • `mcp.vault.generate-smart-acl-policy` runs an interactive workflow that builds and optimises a policy from your requirements
  • `mcp.vault.diagnose-vault-state` scans your cluster and reports where the configuration falls short
  • `mcp.vault.example-acl-policy` and `mcp.vault.generate-acl-policy` return policy JSON you can edit and feed back as tool input
Requirements

Docker, running `matthewschuchard/vault-mcp-server` over stdio, or the `vault-mcp-server` package. Point it at your cluster with `VAULT_URL`, which defaults to `http://127.0.0.1:8200`. `VAULT_AUTH_METHOD` picks between `approle`, `jwt`, `token` and `userpass`, and the matching variables follow — `VAULT_TOKEN`, `VAULT_ROLE_ID` and `VAULT_SECRET_ID`, `VAULT_USERNAME` and `VAULT_PASSWORD`, or `VAULT_JWT` and `VAULT_ROLE`. `VAULT_NAMESPACE` is enterprise-only and `CACHE_TTL` defaults to 60, which is how long reads and lists are served from cache.

Setup effort

One command plus a key — docker run -i --rm -e ENV_VAR -e ENV_VAR_TWO matthewschuchard/vault-mcp-server, then supply credentials