Connectors · Identity & security
HashiCorp Vault MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to HashiCorp Vault and the rest of your systems. It gives your agent 1,018 HashiCorp Vault actions (417 reads, 377 writes and 224 that wait for a confirmation) and holds the HashiCorp Vault credential itself, so the agent never does. It paces HashiCorp Vault's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "hashicorp_vault.approle.list_roles", intent: "check which HashiCorp Vault account is connected"}# List roles (approle) · read · 1 upstream call- 1,018actionsin one signed file
- 417readlook, never change
- 377writecreate and update
- 224wait for a yesdestructive, confirmed first
Set up
Connect HashiCorp Vault in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect HashiCorp Vault.
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
tokenVault token (hvs.… service token, or a batch token) sent as X-Vault-TokenhostWhere your HashiCorp Vault lives: your hostnamespaceYour HashiCorp Vault namespace
account { op: "connections.requirements", service: "hashicorp_vault" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "hashicorp_vault.approle.list_roles" }# list roles (approle) · read · 1 upstream callcheck { action: "hashicorp_vault.sys.wrap", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
HashiCorp Vault at a glance
- Sign-in
- API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
token- Setup fields
hostnamespace- Limits we pace to
- 50 calls a second, per connection
- API covered
- Vault HTTP API v1 (OpenAPI 3.0.2 document generated by Vault 1.15.0 with every builtin plugin mounted at its default path), at your HashiCorp Vault instance's API base URL, which you enter when connecting
- Built from
- HashiCorp Vault's documentation, read 23 October 2026OpenAPI spec (GitHub)developer.hashicorp.com
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- Not cached: every read goes to the vendor
- Shared entities
- 4, so ask can line HashiCorp Vault up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in HashiCorp Vault.
1,018 actions in 34 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 417readlook, never change
- 377writecreate and update
- 224destructivewait for a confirmation
Sys
261109 read · 88 write · 64 destructive
Policies read acl policy · Auditing calculate hash · Decode · Generate hash
Pki
12734 read · 80 write · 13 destructive
Cross sign intermediate (pki) · Generate eab key (pki) · Generate eab key for issuer (pki) · Generate eab key for issuer and role (pki)
Identity
10952 read · 27 write · 30 destructive
Entity read by name · Group read by name · Alias create · Alias list by id
Aws
6829 read · 20 write · 19 destructive
Generate credentials with parameters (aws) · Generate sts credentials with parameters (aws) · List auth roles (aws) · List auth roles2 (aws)
Approle
5118 read · 17 write · 16 destructive
List roles (approle) · List secret ids (approle) · Login (approle) · Look up secret id (approle)
GCP
4521 read · 16 write · 8 destructive
Google cloud generate impersonated account access token2 (gcp) · Google cloud generate roleset access token (gcp) · Google cloud generate roleset access token3 (gcp) · Google cloud generate roleset key (gcp)
Transit
3916 read · 20 write · 3 destructive
Create key (transit) · Decrypt (transit) · Encrypt (transit) · Generate csr for key (transit)
Ldap
3415 read · 11 write · 8 destructive
Library check out (ldap) · Library list (ldap) · List dynamic roles (ldap) · List groups (ldap)
26 more areas · 284 actions
- Gcpkms 21
- Token 21
- Azure 18
- Database 17
- Kubernetes 16
- SSH 16
- Alicloud 14
- Github 13
- KV V2 13
- Okta 12
- Cert 11
- Nomad 11
- JWT 10
- Kerberos 10
- Terraform 10
- CF 8
- Mongodbatlas 8
- Oci 8
- Rabbitmq 8
- Radius 8
- Consul 7
- Userpass 7
- Totp 6
- Cubbyhole 4
- KV V1 4
- Centrify 3
Top actions
The HashiCorp Vault API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
hashicorp_vault.token.look_up_selfLook up self (token) | This endpoint will lookup a token and its properties. | read | this connector |
hashicorp_vault.identity.group_read_by_nameGroup read by name | Group read by name | read | this connector |
hashicorp_vault.identity.entity_read_by_nameEntity read by name | Update, read or delete an entity using entity name | read | this connector |
hashicorp_vault.sys.policies_read_acl_policyPolicies read acl policy | Retrieve information about the named ACL policy. | read | this connector |
hashicorp_vault.sys.wrapWrap | Response-wraps an arbitrary JSON object. | write | this connector |
hashicorp_vault.kv_v1.listList (kv v1) | Pass-through secret storage to the storage backend, allowing you to read/write arbitrary data into secret storage. | read | this connector |
hashicorp_vault.kv_v2.listList (kv v2) | Configures settings for the KV store | read | this connector |
hashicorp_vault.token.createCreate (token) | The token create path is used to create new tokens. | write | this connector |
hashicorp_vault.transit.hashHash (transit) | Generate a hash sum for input data | read | this connector |
hashicorp_vault.transit.signSign (transit) | Generate a signature for input data using the named key | write | this connector |
hashicorp_vault.approle.loginLogin (approle) | Issue a token based on the credentials supplied | write | this connector |
hashicorp_vault.sys.sealSeal | Seal the Vault. | destructive | this connector |
Try it
Prompts to paste into Claude.
Each one names the HashiCorp Vault actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in HashiCorp Vault? List every user and their role.
calls
hashicorp_vault.identity.entity_read_by_name - Writewrite
Wrap in HashiCorp Vault. Show me exactly what you will send before you save it.
calls
hashicorp_vault.sys.wrap
Governance for HashiCorp Vault
Destructive actions wait for a yes.
224 HashiCorp Vault actions are destructive. The first 10:
- Seal
hashicorp_vault.sys.seal - Revoke (pki)
hashicorp_vault.pki.revoke - Delete (kv v1)
hashicorp_vault.kv_v1.delete - Delete (kv v2)
hashicorp_vault.kv_v2.delete - Revoke (token)
hashicorp_vault.token.revoke - Delete key (pki)
hashicorp_vault.pki.delete_key - Raw delete
hashicorp_vault.sys.raw_delete - Delete role (pki)
hashicorp_vault.pki.delete_role - Delete root (pki)
hashicorp_vault.pki.delete_root - Rotate root (pki)
hashicorp_vault.pki.rotate_root
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
Delete (kv v1)?
intent: the user asked me to delete (kv v1)
account { op: "keys.create", name: "hashicorp-vault-agent", allowed_actions: ["hashicorp_vault.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "hashicorp_vault.sys.seal", approver: "[email protected]" }, { match: "hashicorp_vault.pki.revoke", approver: "[email protected]" }, { match: "hashicorp_vault.kv_v1.delete", approver: "[email protected]" } ]}Cost
What HashiCorp Vault costs on actionlake.
Every HashiCorp Vault action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call HashiCorp Vault refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 1,018 HashiCorp Vault actions
- 1,018actions pageeach page of a long list is one call
- 0reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every HashiCorp Vault action.
1,018 actions by area: the id your agent calls, what it does, and its effect.
Sys261
hashicorp_vault.sys.auditing_calculate_hashAuditing calculate hashreadhashicorp_vault.sys.decodeDecodereadhashicorp_vault.sys.generate_hashGenerate hashwritehashicorp_vault.sys.policies_read_acl_policyPolicies read acl policyreadhashicorp_vault.sys.auditing_disable_deviceAuditing disable devicedestructivehashicorp_vault.sys.auditing_disable_request_headerAuditing disable request headerdestructive- and 255 more in this area
Pki127
hashicorp_vault.pki.cross_sign_intermediateCross sign intermediate (pki)writehashicorp_vault.pki.generate_eab_keyGenerate eab key (pki)writehashicorp_vault.pki.generate_eab_key_for_issuerGenerate eab key for issuer (pki)writehashicorp_vault.pki.generate_eab_key_for_issuer_and_roleGenerate eab key for issuer and role (pki)writehashicorp_vault.pki.configure_acmeConfigure acme (pki)writehashicorp_vault.pki.configure_auto_tidyConfigure auto tidy (pki)write- and 121 more in this area
Identity109
hashicorp_vault.identity.alias_createAlias createwritehashicorp_vault.identity.alias_list_by_idAlias list by idreadhashicorp_vault.identity.entity_read_by_nameEntity read by namereadhashicorp_vault.identity.group_read_by_nameGroup read by namereadhashicorp_vault.identity.alias_delete_by_idAlias delete by iddestructivehashicorp_vault.identity.alias_read_by_idAlias read by idread- and 103 more in this area
Aws68
hashicorp_vault.aws.generate_credentials_with_parametersGenerate credentials with parameters (aws)writehashicorp_vault.aws.generate_sts_credentials_with_parametersGenerate sts credentials with parameters (aws)writehashicorp_vault.aws.list_auth_rolesList auth roles (aws)readhashicorp_vault.aws.list_auth_roles2List auth roles2 (aws)readhashicorp_vault.aws.configure_certificateConfigure certificate (aws)writehashicorp_vault.aws.configure_clientConfigure client (aws)write- and 62 more in this area
Approle51
hashicorp_vault.approle.list_rolesList roles (approle)readhashicorp_vault.approle.list_secret_idsList secret ids (approle)readhashicorp_vault.approle.loginLogin (approle)writehashicorp_vault.approle.look_up_secret_idLook up secret id (approle)readhashicorp_vault.approle.delete_bind_secret_idDelete bind secret id (approle)destructivehashicorp_vault.approle.delete_bound_cidr_listDelete bound cidr list (approle)destructive- and 45 more in this area
GCP45
hashicorp_vault.gcp.google_cloud_generate_impersonated_account_access_token2Google cloud generate impersonated account access token2 (gcp)writehashicorp_vault.gcp.google_cloud_generate_roleset_access_tokenGoogle cloud generate roleset access token (gcp)writehashicorp_vault.gcp.google_cloud_generate_roleset_access_token3Google cloud generate roleset access token3 (gcp)writehashicorp_vault.gcp.google_cloud_generate_roleset_keyGoogle cloud generate roleset key (gcp)writehashicorp_vault.gcp.google_cloud_configureGoogle cloud configure (gcp)writehashicorp_vault.gcp.google_cloud_configure_authGoogle cloud configure auth (gcp)write- and 39 more in this area
Transit39
hashicorp_vault.transit.create_keyCreate key (transit)writehashicorp_vault.transit.decryptDecrypt (transit)readhashicorp_vault.transit.encryptEncrypt (transit)readhashicorp_vault.transit.generate_csr_for_keyGenerate csr for key (transit)writehashicorp_vault.transit.back_up_keyBack up key (transit)readhashicorp_vault.transit.byok_keyByok key (transit)read- and 33 more in this area
Ldap34
hashicorp_vault.ldap.library_check_outLibrary check out (ldap)writehashicorp_vault.ldap.library_listLibrary list (ldap)readhashicorp_vault.ldap.list_dynamic_rolesList dynamic roles (ldap)readhashicorp_vault.ldap.list_groupsList groups (ldap)readhashicorp_vault.ldap.configureConfigure (ldap)writehashicorp_vault.ldap.configure_authConfigure auth (ldap)write- and 28 more in this area
Gcpkms21
hashicorp_vault.gcpkms.google_cloud_kms_decryptGoogle cloud kms decrypt (gcpkms)readhashicorp_vault.gcpkms.google_cloud_kms_deregister_keyGoogle cloud kms deregister key (gcpkms)writehashicorp_vault.gcpkms.google_cloud_kms_encryptGoogle cloud kms encrypt (gcpkms)readhashicorp_vault.gcpkms.google_cloud_kms_list_keysGoogle cloud kms list keys (gcpkms)readhashicorp_vault.gcpkms.google_cloud_kms_configureGoogle cloud kms configure (gcpkms)writehashicorp_vault.gcpkms.google_cloud_kms_configure_keyGoogle cloud kms configure key (gcpkms)write- and 15 more in this area
Token21
hashicorp_vault.token.createCreate (token)writehashicorp_vault.token.create_against_roleCreate against role (token)writehashicorp_vault.token.create_orphanCreate orphan (token)writehashicorp_vault.token.look_up_selfLook up self (token)readhashicorp_vault.token.delete_roleDelete role (token)destructivehashicorp_vault.token.list_accessorsList accessors (token)read- and 15 more in this area
Azure18
hashicorp_vault.azure.configureConfigure (azure)writehashicorp_vault.azure.list_auth_rolesList auth roles (azure)readhashicorp_vault.azure.list_rolesList roles (azure)readhashicorp_vault.azure.loginLogin (azure)writehashicorp_vault.azure.configure_authConfigure auth (azure)writehashicorp_vault.azure.delete_auth_configurationDelete auth configuration (azure)destructive- and 12 more in this area
Database17
hashicorp_vault.database.configure_connectionConfigure connection (database)writehashicorp_vault.database.list_connectionsList connections (database)readhashicorp_vault.database.list_rolesList roles (database)readhashicorp_vault.database.list_static_rolesList static roles (database)readhashicorp_vault.database.delete_connection_configurationDelete connection configuration (database)destructivehashicorp_vault.database.delete_roleDelete role (database)destructive- and 11 more in this area
Kubernetes16
hashicorp_vault.kubernetes.generate_credentialsGenerate credentials (kubernetes)writehashicorp_vault.kubernetes.list_auth_rolesList auth roles (kubernetes)readhashicorp_vault.kubernetes.list_rolesList roles (kubernetes)readhashicorp_vault.kubernetes.loginLogin (kubernetes)writehashicorp_vault.kubernetes.check_configurationCheck configuration (kubernetes)readhashicorp_vault.kubernetes.configureConfigure (kubernetes)write- and 10 more in this area
SSH16
hashicorp_vault.ssh.generate_credentialsGenerate credentials (ssh)writehashicorp_vault.ssh.issue_certificateIssue certificate (ssh)writehashicorp_vault.ssh.list_rolesList roles (ssh)readhashicorp_vault.ssh.list_roles_by_ipList roles by ip (ssh)readhashicorp_vault.ssh.configure_caConfigure ca (ssh)writehashicorp_vault.ssh.configure_zero_addressConfigure zero address (ssh)write- and 10 more in this area
Alicloud14
hashicorp_vault.alicloud.list_auth_rolesList auth roles (alicloud)readhashicorp_vault.alicloud.list_auth_roles2List auth roles2 (alicloud)readhashicorp_vault.alicloud.list_rolesList roles (alicloud)readhashicorp_vault.alicloud.loginLogin (alicloud)writehashicorp_vault.alicloud.configureConfigure (alicloud)writehashicorp_vault.alicloud.delete_auth_roleDelete auth role (alicloud)destructive- and 8 more in this area
Github13
hashicorp_vault.github.configureConfigure (github)writehashicorp_vault.github.list_teamsList teams (github)readhashicorp_vault.github.list_usersList users (github)readhashicorp_vault.github.loginLogin (github)writehashicorp_vault.github.delete_team_mappingDelete team mapping (github)destructivehashicorp_vault.github.delete_user_mappingDelete user mapping (github)destructive- and 7 more in this area
KV V213
hashicorp_vault.kv_v2.configureConfigure (kv v2)writehashicorp_vault.kv_v2.listList (kv v2)readhashicorp_vault.kv_v2.readRead (kv v2)readhashicorp_vault.kv_v2.read_configurationRead configuration (kv v2)readhashicorp_vault.kv_v2.deleteDelete (kv v2)destructivehashicorp_vault.kv_v2.delete_metadata_and_all_versionsDelete metadata and all versions (kv v2)destructive- and 7 more in this area
Okta12
hashicorp_vault.okta.configureConfigure (okta)writehashicorp_vault.okta.list_groupsList groups (okta)readhashicorp_vault.okta.list_usersList users (okta)readhashicorp_vault.okta.loginLogin (okta)writehashicorp_vault.okta.delete_groupDelete group (okta)destructivehashicorp_vault.okta.delete_userDelete user (okta)destructive- and 6 more in this area
Cert11
hashicorp_vault.cert.configureConfigure (cert)writehashicorp_vault.cert.list_certificatesList certificates (cert)readhashicorp_vault.cert.list_crlsList crls (cert)readhashicorp_vault.cert.loginLogin (cert)writehashicorp_vault.cert.delete_certificateDelete certificate (cert)destructivehashicorp_vault.cert.delete_crlDelete crl (cert)destructive- and 5 more in this area
Nomad11
hashicorp_vault.nomad.configure_accessConfigure access (nomad)writehashicorp_vault.nomad.configure_leaseConfigure lease (nomad)writehashicorp_vault.nomad.generate_credentialsGenerate credentials (nomad)readhashicorp_vault.nomad.list_rolesList roles (nomad)readhashicorp_vault.nomad.delete_access_configurationDelete access configuration (nomad)destructivehashicorp_vault.nomad.delete_lease_configurationDelete lease configuration (nomad)destructive- and 5 more in this area
JWT10
hashicorp_vault.jwt.list_rolesList roles (jwt)readhashicorp_vault.jwt.loginLogin (jwt)writehashicorp_vault.jwt.oidc_callback_form_postOidc callback form post (jwt)writehashicorp_vault.jwt.oidc_request_authorization_urlOidc request authorization url (jwt)writehashicorp_vault.jwt.configureConfigure (jwt)writehashicorp_vault.jwt.delete_roleDelete role (jwt)destructive- and 4 more in this area
Kerberos10
hashicorp_vault.kerberos.configureConfigure (kerberos)writehashicorp_vault.kerberos.configure_ldapConfigure ldap (kerberos)writehashicorp_vault.kerberos.list_groupsList groups (kerberos)readhashicorp_vault.kerberos.loginLogin (kerberos)writehashicorp_vault.kerberos.delete_groupDelete group (kerberos)destructivehashicorp_vault.kerberos.login2Login2 (kerberos)read- and 4 more in this area
Terraform10
hashicorp_vault.terraform.cloud_configureCloud configure (terraform)writehashicorp_vault.terraform.cloud_generate_credentialsCloud generate credentials (terraform)readhashicorp_vault.terraform.cloud_generate_credentials2Cloud generate credentials2 (terraform)writehashicorp_vault.terraform.cloud_list_rolesCloud list roles (terraform)readhashicorp_vault.terraform.cloud_delete_configurationCloud delete configuration (terraform)destructivehashicorp_vault.terraform.cloud_delete_roleCloud delete role (terraform)destructive- and 4 more in this area
CF8
hashicorp_vault.cf.cloud_foundry_configureCloud foundry configure (cf)writehashicorp_vault.cf.cloud_foundry_list_rolesCloud foundry list roles (cf)readhashicorp_vault.cf.cloud_foundry_loginCloud foundry login (cf)writehashicorp_vault.cf.cloud_foundry_read_configurationCloud foundry read configuration (cf)readhashicorp_vault.cf.cloud_foundry_delete_configurationCloud foundry delete configuration (cf)destructivehashicorp_vault.cf.cloud_foundry_delete_roleCloud foundry delete role (cf)destructive- and 2 more in this area
Mongodbatlas8
hashicorp_vault.mongodbatlas.configureConfigure (mongodbatlas)writehashicorp_vault.mongodbatlas.generate_credentialsGenerate credentials (mongodbatlas)readhashicorp_vault.mongodbatlas.generate_credentials2Generate credentials2 (mongodbatlas)writehashicorp_vault.mongodbatlas.list_rolesList roles (mongodbatlas)readhashicorp_vault.mongodbatlas.delete_roleDelete role (mongodbatlas)destructivehashicorp_vault.mongodbatlas.read_configurationRead configuration (mongodbatlas)read- and 2 more in this area
Oci8
hashicorp_vault.oci.configureConfigure (oci)writehashicorp_vault.oci.list_rolesList roles (oci)readhashicorp_vault.oci.loginLogin (oci)writehashicorp_vault.oci.read_configurationRead configuration (oci)readhashicorp_vault.oci.delete_configurationDelete configuration (oci)destructivehashicorp_vault.oci.delete_roleDelete role (oci)destructive- and 2 more in this area
Rabbitmq8
hashicorp_vault.rabbitmq.configure_connectionConfigure connection (rabbitmq)writehashicorp_vault.rabbitmq.configure_leaseConfigure lease (rabbitmq)writehashicorp_vault.rabbitmq.list_rolesList roles (rabbitmq)readhashicorp_vault.rabbitmq.read_lease_configurationRead lease configuration (rabbitmq)readhashicorp_vault.rabbitmq.delete_roleDelete role (rabbitmq)destructivehashicorp_vault.rabbitmq.read_roleRead role (rabbitmq)read- and 2 more in this area
Radius8
hashicorp_vault.radius.configureConfigure (radius)writehashicorp_vault.radius.list_usersList users (radius)readhashicorp_vault.radius.loginLogin (radius)writehashicorp_vault.radius.login_with_usernameLogin with username (radius)writehashicorp_vault.radius.delete_userDelete user (radius)destructivehashicorp_vault.radius.read_configurationRead configuration (radius)read- and 2 more in this area
Consul7
hashicorp_vault.consul.configure_accessConfigure access (consul)writehashicorp_vault.consul.generate_credentialsGenerate credentials (consul)readhashicorp_vault.consul.list_rolesList roles (consul)readhashicorp_vault.consul.read_access_configurationRead access configuration (consul)readhashicorp_vault.consul.delete_roleDelete role (consul)destructivehashicorp_vault.consul.read_roleRead role (consul)read- and 1 more in this area
Userpass7
hashicorp_vault.userpass.list_usersList users (userpass)readhashicorp_vault.userpass.loginLogin (userpass)writehashicorp_vault.userpass.read_userRead user (userpass)readhashicorp_vault.userpass.update_policiesUpdate policies (userpass)writehashicorp_vault.userpass.delete_userDelete user (userpass)destructivehashicorp_vault.userpass.reset_passwordReset password (userpass)destructive- and 1 more in this area
Totp6
hashicorp_vault.totp.create_keyCreate key (totp)writehashicorp_vault.totp.generate_codeGenerate code (totp)readhashicorp_vault.totp.list_keysList keys (totp)readhashicorp_vault.totp.validate_codeValidate code (totp)readhashicorp_vault.totp.delete_keyDelete key (totp)destructivehashicorp_vault.totp.read_keyRead key (totp)read
Cubbyhole4
hashicorp_vault.cubbyhole.deleteDelete (cubbyhole)destructivehashicorp_vault.cubbyhole.listList (cubbyhole)readhashicorp_vault.cubbyhole.readRead (cubbyhole)readhashicorp_vault.cubbyhole.writeWrite (cubbyhole)write
KV V14
hashicorp_vault.kv_v1.deleteDelete (kv v1)destructivehashicorp_vault.kv_v1.listList (kv v1)readhashicorp_vault.kv_v1.readRead (kv v1)readhashicorp_vault.kv_v1.writeWrite (kv v1)write
Centrify3
hashicorp_vault.centrify.configureConfigure (centrify)writehashicorp_vault.centrify.loginLogin (centrify)writehashicorp_vault.centrify.read_configurationRead configuration (centrify)read
This index shows a sample of each area. All 1,018 actions, with their inputs and prices, are in the catalogue, which a free sandbox key can search.
Questions
The HashiCorp Vault MCP server, answered.
Is there a HashiCorp Vault MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 1,018 HashiCorp Vault actions across sys, pki, identity and aws, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by HashiCorp Vault.
What do I need to connect HashiCorp Vault?
Vault token (hvs.… service token, or a batch token) sent as X-Vault-Token. Plus your host and your namespace. The free call account { op: "connections.requirements", service: "hashicorp_vault" } lists exactly what to paste.
Can an AI agent delete or change things in HashiCorp Vault?
Only if its key allows it, and only with an explicit confirmation. 224 HashiCorp Vault actions are destructive, including seal, revoke (pki) and delete (kv v1). Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my HashiCorp Vault API limit?
actionlake paces every call to the limits in the HashiCorp Vault service file: 50 calls a second per connection.
What does a HashiCorp Vault action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (1,018 HashiCorp Vault actions page). Cache hits, searches, dry runs and calls HashiCorp Vault refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which HashiCorp Vault API does it cover?
The Vault HTTP API v1 (OpenAPI 3.0.2 document generated by Vault 1.15.0 with every builtin plugin mounted at its default path) at your HashiCorp Vault instance's API base URL, which you enter when connecting. It is built from HashiCorp Vault's documentation as read on 23 October 2026. 1,018 actions in 34 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my HashiCorp Vault data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. HashiCorp Vault responses are not cached. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your HashiCorp Vault credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent HashiCorp Vault today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
