Vault MCP Server

docker run -i --rm -e VAULT_ADDR -e VAULT_TOKEN hashicorp/vault-mcp-server

{
  "mcpServers": {
    "vault-mcp": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "VAULT_ADDR",
        "-e",
        "VAULT_TOKEN",
        "hashicorp/vault-mcp-server"
      ]
    }
  }
}

Covers three areas of a Vault instance: creating, listing and deleting mounts, full read/write/delete access to KV v1 and v2 paths, and the PKI surface — enabling the engine, managing issuers and roles, and issuing certificates. It is a Go binary distributed as a HashiCorp release and a Docker image, taking VAULT_ADDR, VAULT_TOKEN and an optional namespace from the environment or, in HTTP mode, from per-request headers. The project is explicit that it is meant for local use with trusted clients, because answering a question about a secret means putting that secret in front of the model. HTTP mode ships CORS controls, rate limits and TLS options for the same reason.