--- title: "HashiCorp Vault MCP server for AI agents - actionlake" description: "Give Claude 1,018 HashiCorp Vault actions through one MCP server: sys, pki, identity, aws. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/hashicorp-vault updated: 2026-10-23 --- Connectors · Identity & security # HashiCorp Vault MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to HashiCorp Vault and the rest of your systems. It gives your agent 1,018 HashiCorp Vault actions (417 reads, 377 writes and 224 that wait for a confirmation) and holds the HashiCorp Vault credential itself, so the agent never does. It paces HashiCorp Vault's limits and records every call. [Connect HashiCorp Vault free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "hashicorp_vault.approle.list_roles", intent: "check which HashiCorp Vault account is connected" } # List roles (approle) · read · 1 upstream call ``` - 1,018 actions in one signed file - 417 read look, never change - 377 write create and update - 224 wait for a yes destructive, confirmed first Set up ## Connect HashiCorp Vault in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect HashiCorp Vault. API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `token` Vault token (hvs.… service token, or a batch token) sent as X-Vault-Token - `host` Where your HashiCorp Vault lives: your host - `namespace` Your HashiCorp Vault namespace ``` account { op: "connections.requirements", service: "hashicorp_vault" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "hashicorp_vault.approle.list_roles" } # list roles (approle) · read · 1 upstream call check { action: "hashicorp_vault.sys.wrap", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` HashiCorp Vault at a glance **Sign-in** API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `token` **Setup fields** `host` `namespace` **Limits we pace to** 50 calls a second, per connection **API covered** Vault HTTP API v1 (OpenAPI 3.0.2 document generated by Vault 1.15.0 with every builtin plugin mounted at its default path), at your HashiCorp Vault instance's API base URL, which you enter when connecting **Built from** HashiCorp Vault's documentation, read 23 October 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/hashicorp/vault-client-go/main/openapi.json) [developer.hashicorp.com](https://developer.hashicorp.com/vault/api-docs) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** Not cached: every read goes to the vendor **Shared entities** 4, so ask can line HashiCorp Vault up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in HashiCorp Vault. 1,018 actions in 34 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **417** read look, never change - **377** write create and update - **224** destructive wait for a confirmation 1. ### Sys 261 109 read · 88 write · 64 destructive Policies read acl policy · Auditing calculate hash · Decode · Generate hash 2. ### Pki 127 34 read · 80 write · 13 destructive Cross sign intermediate (pki) · Generate eab key (pki) · Generate eab key for issuer (pki) · Generate eab key for issuer and role (pki) 3. ### Identity 109 52 read · 27 write · 30 destructive Entity read by name · Group read by name · Alias create · Alias list by id 4. ### Aws 68 29 read · 20 write · 19 destructive Generate credentials with parameters (aws) · Generate sts credentials with parameters (aws) · List auth roles (aws) · List auth roles2 (aws) 5. ### Approle 51 18 read · 17 write · 16 destructive List roles (approle) · List secret ids (approle) · Login (approle) · Look up secret id (approle) 6. ### GCP 45 21 read · 16 write · 8 destructive Google cloud generate impersonated account access token2 (gcp) · Google cloud generate roleset access token (gcp) · Google cloud generate roleset access token3 (gcp) · Google cloud generate roleset key (gcp) 7. ### Transit 39 16 read · 20 write · 3 destructive Create key (transit) · Decrypt (transit) · Encrypt (transit) · Generate csr for key (transit) 8. ### Ldap 34 15 read · 11 write · 8 destructive Library check out (ldap) · Library list (ldap) · List dynamic roles (ldap) · List groups (ldap) **26 more areas · 284 actions** - Gcpkms **21** - Token **21** - Azure **18** - Database **17** - Kubernetes **16** - SSH **16** - Alicloud **14** - Github **13** - KV V2 **13** - Okta **12** - Cert **11** - Nomad **11** - JWT **10** - Kerberos **10** - Terraform **10** - CF **8** - Mongodbatlas **8** - Oci **8** - Rabbitmq **8** - Radius **8** - Consul **7** - Userpass **7** - Totp **6** - Cubbyhole **4** - KV V1 **4** - Centrify **3** Top actions ## The HashiCorp Vault API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `hashicorp_vault.token.look_up_self` Look up self (token) | This endpoint will lookup a token and its properties. | read | this connector | | `hashicorp_vault.identity.group_read_by_name` Group read by name | Group read by name | read | this connector | | `hashicorp_vault.identity.entity_read_by_name` Entity read by name | Update, read or delete an entity using entity name | read | this connector | | `hashicorp_vault.sys.policies_read_acl_policy` Policies read acl policy | Retrieve information about the named ACL policy. | read | this connector | | `hashicorp_vault.sys.wrap` Wrap | Response-wraps an arbitrary JSON object. | write | this connector | | `hashicorp_vault.kv_v1.list` List (kv v1) | Pass-through secret storage to the storage backend, allowing you to read/write arbitrary data into secret storage. | read | this connector | | `hashicorp_vault.kv_v2.list` List (kv v2) | Configures settings for the KV store | read | this connector | | `hashicorp_vault.token.create` Create (token) | The token create path is used to create new tokens. | write | this connector | | `hashicorp_vault.transit.hash` Hash (transit) | Generate a hash sum for input data | read | this connector | | `hashicorp_vault.transit.sign` Sign (transit) | Generate a signature for input data using the named key | write | this connector | | `hashicorp_vault.approle.login` Login (approle) | Issue a token based on the credentials supplied | write | this connector | | `hashicorp_vault.sys.seal` Seal | Seal the Vault. | destructive | this connector | Try it ## Prompts to paste into Claude. Each one names the HashiCorp Vault actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Who has access in HashiCorp Vault? List every user and their role. calls `hashicorp_vault.identity.entity_read_by_name` 2. Write write Wrap in HashiCorp Vault. Show me exactly what you will send before you save it. calls `hashicorp_vault.sys.wrap` Governance for HashiCorp Vault ## Destructive actions wait for a yes. 224 HashiCorp Vault actions are destructive. The first 10: - Seal `hashicorp_vault.sys.seal` - Revoke (pki) `hashicorp_vault.pki.revoke` - Delete (kv v1) `hashicorp_vault.kv_v1.delete` - Delete (kv v2) `hashicorp_vault.kv_v2.delete` - Revoke (token) `hashicorp_vault.token.revoke` - Delete key (pki) `hashicorp_vault.pki.delete_key` - Raw delete `hashicorp_vault.sys.raw_delete` - Delete role (pki) `hashicorp_vault.pki.delete_role` - Delete root (pki) `hashicorp_vault.pki.delete_root` - Rotate root (pki) `hashicorp_vault.pki.rotate_root` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do hashicorp_vault.kv_v1.delete confirm_policy: **human** Delete (kv v1)? **intent:** the user asked me to delete (kv v1) run suspended · waiting for a named person · key _hashicorp-vault-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "hashicorp-vault-agent", allowed_actions: ["hashicorp_vault.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "hashicorp_vault.sys.seal", approver: "lead@example.com" }, { match: "hashicorp_vault.pki.revoke", approver: "lead@example.com" }, { match: "hashicorp_vault.kv_v1.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to HashiCorp Vault only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What HashiCorp Vault costs on actionlake. Every HashiCorp Vault action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call HashiCorp Vault refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 1,018 HashiCorp Vault actions - 1,018 actions page each page of a long list is one call - 0 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every HashiCorp Vault action. 1,018 actions by area: the id your agent calls, what it does, and its effect. **Sys 261** - `hashicorp_vault.sys.auditing_calculate_hash` Auditing calculate hash read - `hashicorp_vault.sys.decode` Decode read - `hashicorp_vault.sys.generate_hash` Generate hash write - `hashicorp_vault.sys.policies_read_acl_policy` Policies read acl policy read - `hashicorp_vault.sys.auditing_disable_device` Auditing disable device destructive - `hashicorp_vault.sys.auditing_disable_request_header` Auditing disable request header destructive - and 255 more in this area **Pki 127** - `hashicorp_vault.pki.cross_sign_intermediate` Cross sign intermediate (pki) write - `hashicorp_vault.pki.generate_eab_key` Generate eab key (pki) write - `hashicorp_vault.pki.generate_eab_key_for_issuer` Generate eab key for issuer (pki) write - `hashicorp_vault.pki.generate_eab_key_for_issuer_and_role` Generate eab key for issuer and role (pki) write - `hashicorp_vault.pki.configure_acme` Configure acme (pki) write - `hashicorp_vault.pki.configure_auto_tidy` Configure auto tidy (pki) write - and 121 more in this area **Identity 109** - `hashicorp_vault.identity.alias_create` Alias create write - `hashicorp_vault.identity.alias_list_by_id` Alias list by id read - `hashicorp_vault.identity.entity_read_by_name` Entity read by name read - `hashicorp_vault.identity.group_read_by_name` Group read by name read - `hashicorp_vault.identity.alias_delete_by_id` Alias delete by id destructive - `hashicorp_vault.identity.alias_read_by_id` Alias read by id read - and 103 more in this area **Aws 68** - `hashicorp_vault.aws.generate_credentials_with_parameters` Generate credentials with parameters (aws) write - `hashicorp_vault.aws.generate_sts_credentials_with_parameters` Generate sts credentials with parameters (aws) write - `hashicorp_vault.aws.list_auth_roles` List auth roles (aws) read - `hashicorp_vault.aws.list_auth_roles2` List auth roles2 (aws) read - `hashicorp_vault.aws.configure_certificate` Configure certificate (aws) write - `hashicorp_vault.aws.configure_client` Configure client (aws) write - and 62 more in this area **Approle 51** - `hashicorp_vault.approle.list_roles` List roles (approle) read - `hashicorp_vault.approle.list_secret_ids` List secret ids (approle) read - `hashicorp_vault.approle.login` Login (approle) write - `hashicorp_vault.approle.look_up_secret_id` Look up secret id (approle) read - `hashicorp_vault.approle.delete_bind_secret_id` Delete bind secret id (approle) destructive - `hashicorp_vault.approle.delete_bound_cidr_list` Delete bound cidr list (approle) destructive - and 45 more in this area **GCP 45** - `hashicorp_vault.gcp.google_cloud_generate_impersonated_account_access_token2` Google cloud generate impersonated account access token2 (gcp) write - `hashicorp_vault.gcp.google_cloud_generate_roleset_access_token` Google cloud generate roleset access token (gcp) write - `hashicorp_vault.gcp.google_cloud_generate_roleset_access_token3` Google cloud generate roleset access token3 (gcp) write - `hashicorp_vault.gcp.google_cloud_generate_roleset_key` Google cloud generate roleset key (gcp) write - `hashicorp_vault.gcp.google_cloud_configure` Google cloud configure (gcp) write - `hashicorp_vault.gcp.google_cloud_configure_auth` Google cloud configure auth (gcp) write - and 39 more in this area **Transit 39** - `hashicorp_vault.transit.create_key` Create key (transit) write - `hashicorp_vault.transit.decrypt` Decrypt (transit) read - `hashicorp_vault.transit.encrypt` Encrypt (transit) read - `hashicorp_vault.transit.generate_csr_for_key` Generate csr for key (transit) write - `hashicorp_vault.transit.back_up_key` Back up key (transit) read - `hashicorp_vault.transit.byok_key` Byok key (transit) read - and 33 more in this area **Ldap 34** - `hashicorp_vault.ldap.library_check_out` Library check out (ldap) write - `hashicorp_vault.ldap.library_list` Library list (ldap) read - `hashicorp_vault.ldap.list_dynamic_roles` List dynamic roles (ldap) read - `hashicorp_vault.ldap.list_groups` List groups (ldap) read - `hashicorp_vault.ldap.configure` Configure (ldap) write - `hashicorp_vault.ldap.configure_auth` Configure auth (ldap) write - and 28 more in this area **Gcpkms 21** - `hashicorp_vault.gcpkms.google_cloud_kms_decrypt` Google cloud kms decrypt (gcpkms) read - `hashicorp_vault.gcpkms.google_cloud_kms_deregister_key` Google cloud kms deregister key (gcpkms) write - `hashicorp_vault.gcpkms.google_cloud_kms_encrypt` Google cloud kms encrypt (gcpkms) read - `hashicorp_vault.gcpkms.google_cloud_kms_list_keys` Google cloud kms list keys (gcpkms) read - `hashicorp_vault.gcpkms.google_cloud_kms_configure` Google cloud kms configure (gcpkms) write - `hashicorp_vault.gcpkms.google_cloud_kms_configure_key` Google cloud kms configure key (gcpkms) write - and 15 more in this area **Token 21** - `hashicorp_vault.token.create` Create (token) write - `hashicorp_vault.token.create_against_role` Create against role (token) write - `hashicorp_vault.token.create_orphan` Create orphan (token) write - `hashicorp_vault.token.look_up_self` Look up self (token) read - `hashicorp_vault.token.delete_role` Delete role (token) destructive - `hashicorp_vault.token.list_accessors` List accessors (token) read - and 15 more in this area **Azure 18** - `hashicorp_vault.azure.configure` Configure (azure) write - `hashicorp_vault.azure.list_auth_roles` List auth roles (azure) read - `hashicorp_vault.azure.list_roles` List roles (azure) read - `hashicorp_vault.azure.login` Login (azure) write - `hashicorp_vault.azure.configure_auth` Configure auth (azure) write - `hashicorp_vault.azure.delete_auth_configuration` Delete auth configuration (azure) destructive - and 12 more in this area **Database 17** - `hashicorp_vault.database.configure_connection` Configure connection (database) write - `hashicorp_vault.database.list_connections` List connections (database) read - `hashicorp_vault.database.list_roles` List roles (database) read - `hashicorp_vault.database.list_static_roles` List static roles (database) read - `hashicorp_vault.database.delete_connection_configuration` Delete connection configuration (database) destructive - `hashicorp_vault.database.delete_role` Delete role (database) destructive - and 11 more in this area **Kubernetes 16** - `hashicorp_vault.kubernetes.generate_credentials` Generate credentials (kubernetes) write - `hashicorp_vault.kubernetes.list_auth_roles` List auth roles (kubernetes) read - `hashicorp_vault.kubernetes.list_roles` List roles (kubernetes) read - `hashicorp_vault.kubernetes.login` Login (kubernetes) write - `hashicorp_vault.kubernetes.check_configuration` Check configuration (kubernetes) read - `hashicorp_vault.kubernetes.configure` Configure (kubernetes) write - and 10 more in this area **SSH 16** - `hashicorp_vault.ssh.generate_credentials` Generate credentials (ssh) write - `hashicorp_vault.ssh.issue_certificate` Issue certificate (ssh) write - `hashicorp_vault.ssh.list_roles` List roles (ssh) read - `hashicorp_vault.ssh.list_roles_by_ip` List roles by ip (ssh) read - `hashicorp_vault.ssh.configure_ca` Configure ca (ssh) write - `hashicorp_vault.ssh.configure_zero_address` Configure zero address (ssh) write - and 10 more in this area **Alicloud 14** - `hashicorp_vault.alicloud.list_auth_roles` List auth roles (alicloud) read - `hashicorp_vault.alicloud.list_auth_roles2` List auth roles2 (alicloud) read - `hashicorp_vault.alicloud.list_roles` List roles (alicloud) read - `hashicorp_vault.alicloud.login` Login (alicloud) write - `hashicorp_vault.alicloud.configure` Configure (alicloud) write - `hashicorp_vault.alicloud.delete_auth_role` Delete auth role (alicloud) destructive - and 8 more in this area **Github 13** - `hashicorp_vault.github.configure` Configure (github) write - `hashicorp_vault.github.list_teams` List teams (github) read - `hashicorp_vault.github.list_users` List users (github) read - `hashicorp_vault.github.login` Login (github) write - `hashicorp_vault.github.delete_team_mapping` Delete team mapping (github) destructive - `hashicorp_vault.github.delete_user_mapping` Delete user mapping (github) destructive - and 7 more in this area **KV V2 13** - `hashicorp_vault.kv_v2.configure` Configure (kv v2) write - `hashicorp_vault.kv_v2.list` List (kv v2) read - `hashicorp_vault.kv_v2.read` Read (kv v2) read - `hashicorp_vault.kv_v2.read_configuration` Read configuration (kv v2) read - `hashicorp_vault.kv_v2.delete` Delete (kv v2) destructive - `hashicorp_vault.kv_v2.delete_metadata_and_all_versions` Delete metadata and all versions (kv v2) destructive - and 7 more in this area **Okta 12** - `hashicorp_vault.okta.configure` Configure (okta) write - `hashicorp_vault.okta.list_groups` List groups (okta) read - `hashicorp_vault.okta.list_users` List users (okta) read - `hashicorp_vault.okta.login` Login (okta) write - `hashicorp_vault.okta.delete_group` Delete group (okta) destructive - `hashicorp_vault.okta.delete_user` Delete user (okta) destructive - and 6 more in this area **Cert 11** - `hashicorp_vault.cert.configure` Configure (cert) write - `hashicorp_vault.cert.list_certificates` List certificates (cert) read - `hashicorp_vault.cert.list_crls` List crls (cert) read - `hashicorp_vault.cert.login` Login (cert) write - `hashicorp_vault.cert.delete_certificate` Delete certificate (cert) destructive - `hashicorp_vault.cert.delete_crl` Delete crl (cert) destructive - and 5 more in this area **Nomad 11** - `hashicorp_vault.nomad.configure_access` Configure access (nomad) write - `hashicorp_vault.nomad.configure_lease` Configure lease (nomad) write - `hashicorp_vault.nomad.generate_credentials` Generate credentials (nomad) read - `hashicorp_vault.nomad.list_roles` List roles (nomad) read - `hashicorp_vault.nomad.delete_access_configuration` Delete access configuration (nomad) destructive - `hashicorp_vault.nomad.delete_lease_configuration` Delete lease configuration (nomad) destructive - and 5 more in this area **JWT 10** - `hashicorp_vault.jwt.list_roles` List roles (jwt) read - `hashicorp_vault.jwt.login` Login (jwt) write - `hashicorp_vault.jwt.oidc_callback_form_post` Oidc callback form post (jwt) write - `hashicorp_vault.jwt.oidc_request_authorization_url` Oidc request authorization url (jwt) write - `hashicorp_vault.jwt.configure` Configure (jwt) write - `hashicorp_vault.jwt.delete_role` Delete role (jwt) destructive - and 4 more in this area **Kerberos 10** - `hashicorp_vault.kerberos.configure` Configure (kerberos) write - `hashicorp_vault.kerberos.configure_ldap` Configure ldap (kerberos) write - `hashicorp_vault.kerberos.list_groups` List groups (kerberos) read - `hashicorp_vault.kerberos.login` Login (kerberos) write - `hashicorp_vault.kerberos.delete_group` Delete group (kerberos) destructive - `hashicorp_vault.kerberos.login2` Login2 (kerberos) read - and 4 more in this area **Terraform 10** - `hashicorp_vault.terraform.cloud_configure` Cloud configure (terraform) write - `hashicorp_vault.terraform.cloud_generate_credentials` Cloud generate credentials (terraform) read - `hashicorp_vault.terraform.cloud_generate_credentials2` Cloud generate credentials2 (terraform) write - `hashicorp_vault.terraform.cloud_list_roles` Cloud list roles (terraform) read - `hashicorp_vault.terraform.cloud_delete_configuration` Cloud delete configuration (terraform) destructive - `hashicorp_vault.terraform.cloud_delete_role` Cloud delete role (terraform) destructive - and 4 more in this area **CF 8** - `hashicorp_vault.cf.cloud_foundry_configure` Cloud foundry configure (cf) write - `hashicorp_vault.cf.cloud_foundry_list_roles` Cloud foundry list roles (cf) read - `hashicorp_vault.cf.cloud_foundry_login` Cloud foundry login (cf) write - `hashicorp_vault.cf.cloud_foundry_read_configuration` Cloud foundry read configuration (cf) read - `hashicorp_vault.cf.cloud_foundry_delete_configuration` Cloud foundry delete configuration (cf) destructive - `hashicorp_vault.cf.cloud_foundry_delete_role` Cloud foundry delete role (cf) destructive - and 2 more in this area **Mongodbatlas 8** - `hashicorp_vault.mongodbatlas.configure` Configure (mongodbatlas) write - `hashicorp_vault.mongodbatlas.generate_credentials` Generate credentials (mongodbatlas) read - `hashicorp_vault.mongodbatlas.generate_credentials2` Generate credentials2 (mongodbatlas) write - `hashicorp_vault.mongodbatlas.list_roles` List roles (mongodbatlas) read - `hashicorp_vault.mongodbatlas.delete_role` Delete role (mongodbatlas) destructive - `hashicorp_vault.mongodbatlas.read_configuration` Read configuration (mongodbatlas) read - and 2 more in this area **Oci 8** - `hashicorp_vault.oci.configure` Configure (oci) write - `hashicorp_vault.oci.list_roles` List roles (oci) read - `hashicorp_vault.oci.login` Login (oci) write - `hashicorp_vault.oci.read_configuration` Read configuration (oci) read - `hashicorp_vault.oci.delete_configuration` Delete configuration (oci) destructive - `hashicorp_vault.oci.delete_role` Delete role (oci) destructive - and 2 more in this area **Rabbitmq 8** - `hashicorp_vault.rabbitmq.configure_connection` Configure connection (rabbitmq) write - `hashicorp_vault.rabbitmq.configure_lease` Configure lease (rabbitmq) write - `hashicorp_vault.rabbitmq.list_roles` List roles (rabbitmq) read - `hashicorp_vault.rabbitmq.read_lease_configuration` Read lease configuration (rabbitmq) read - `hashicorp_vault.rabbitmq.delete_role` Delete role (rabbitmq) destructive - `hashicorp_vault.rabbitmq.read_role` Read role (rabbitmq) read - and 2 more in this area **Radius 8** - `hashicorp_vault.radius.configure` Configure (radius) write - `hashicorp_vault.radius.list_users` List users (radius) read - `hashicorp_vault.radius.login` Login (radius) write - `hashicorp_vault.radius.login_with_username` Login with username (radius) write - `hashicorp_vault.radius.delete_user` Delete user (radius) destructive - `hashicorp_vault.radius.read_configuration` Read configuration (radius) read - and 2 more in this area **Consul 7** - `hashicorp_vault.consul.configure_access` Configure access (consul) write - `hashicorp_vault.consul.generate_credentials` Generate credentials (consul) read - `hashicorp_vault.consul.list_roles` List roles (consul) read - `hashicorp_vault.consul.read_access_configuration` Read access configuration (consul) read - `hashicorp_vault.consul.delete_role` Delete role (consul) destructive - `hashicorp_vault.consul.read_role` Read role (consul) read - and 1 more in this area **Userpass 7** - `hashicorp_vault.userpass.list_users` List users (userpass) read - `hashicorp_vault.userpass.login` Login (userpass) write - `hashicorp_vault.userpass.read_user` Read user (userpass) read - `hashicorp_vault.userpass.update_policies` Update policies (userpass) write - `hashicorp_vault.userpass.delete_user` Delete user (userpass) destructive - `hashicorp_vault.userpass.reset_password` Reset password (userpass) destructive - and 1 more in this area **Totp 6** - `hashicorp_vault.totp.create_key` Create key (totp) write - `hashicorp_vault.totp.generate_code` Generate code (totp) read - `hashicorp_vault.totp.list_keys` List keys (totp) read - `hashicorp_vault.totp.validate_code` Validate code (totp) read - `hashicorp_vault.totp.delete_key` Delete key (totp) destructive - `hashicorp_vault.totp.read_key` Read key (totp) read **Cubbyhole 4** - `hashicorp_vault.cubbyhole.delete` Delete (cubbyhole) destructive - `hashicorp_vault.cubbyhole.list` List (cubbyhole) read - `hashicorp_vault.cubbyhole.read` Read (cubbyhole) read - `hashicorp_vault.cubbyhole.write` Write (cubbyhole) write **KV V1 4** - `hashicorp_vault.kv_v1.delete` Delete (kv v1) destructive - `hashicorp_vault.kv_v1.list` List (kv v1) read - `hashicorp_vault.kv_v1.read` Read (kv v1) read - `hashicorp_vault.kv_v1.write` Write (kv v1) write **Centrify 3** - `hashicorp_vault.centrify.configure` Configure (centrify) write - `hashicorp_vault.centrify.login` Login (centrify) write - `hashicorp_vault.centrify.read_configuration` Read configuration (centrify) read This index shows a sample of each area. All 1,018 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The HashiCorp Vault MCP server, answered. **Is there a HashiCorp Vault MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 1,018 HashiCorp Vault actions across sys, pki, identity and aws, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by HashiCorp Vault. **What do I need to connect HashiCorp Vault?** Vault token (hvs.… service token, or a batch token) sent as X-Vault-Token. Plus your host and your namespace. The free call account { op: "connections.requirements", service: "hashicorp_vault" } lists exactly what to paste. **Can an AI agent delete or change things in HashiCorp Vault?** Only if its key allows it, and only with an explicit confirmation. 224 HashiCorp Vault actions are destructive, including seal, revoke (pki) and delete (kv v1). Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my HashiCorp Vault API limit?** actionlake paces every call to the limits in the HashiCorp Vault service file: 50 calls a second per connection. **What does a HashiCorp Vault action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (1,018 HashiCorp Vault actions page). Cache hits, searches, dry runs and calls HashiCorp Vault refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which HashiCorp Vault API does it cover?** The Vault HTTP API v1 (OpenAPI 3.0.2 document generated by Vault 1.15.0 with every builtin plugin mounted at its default path) at your HashiCorp Vault instance's API base URL, which you enter when connecting. It is built from HashiCorp Vault's documentation as read on 23 October 2026. 1,018 actions in 34 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my HashiCorp Vault data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. HashiCorp Vault responses are not cached. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your HashiCorp Vault credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like HashiCorp Vault Joins with, on shared entities - [Fortinet FortiGate 3](https://actionlake.com/connectors/fortinet-fortigate) - [Databricks 3](https://actionlake.com/connectors/databricks) - [Delinea Secret Server 3](https://actionlake.com/connectors/delinea-secret-server) - [authentik 3](https://actionlake.com/connectors/authentik) - [Lightdash 3](https://actionlake.com/connectors/lightdash) - [Spacelift 3](https://actionlake.com/connectors/spacelift) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by HashiCorp Vault; the name is the vendor's own. Counts are from the HashiCorp Vault service file, version 1.0.0. ## Give your agent HashiCorp Vault today. [Connect HashiCorp Vault free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/hashicorp-vault More: https://actionlake.com/llms.txt