KosmoKrator

productivity

HashiCorp Vault MCP Integration for Claude Code

Connect HashiCorp Vault to Claude Code through the local KosmoKrator MCP gateway with scoped tools, credentials, and write policy.

7 functions 5 read 2 write API token auth
Submit HashiCorp Vault feedback View package source

Connect HashiCorp Vault to Claude Code

Connect local KosmoKrator integrations to Claude Code through one scoped MCP gateway entry.

Add KosmoKrator as a stdio MCP server in the Claude Code project config and select the integrations that should be visible. The gateway is local, scoped to this integration, and starts with --write=deny so Claude Code can inspect read-capable tools without receiving write access by default.

HashiCorp Vault MCP Config for Claude Code

Claude Code can launch the local kosmo binary directly from the project MCP config.

{
  "mcpServers": {
    "kosmokrator-vault": {
      "type": "stdio",
      "command": "kosmo",
      "args": [
        "mcp:serve",
        "--integration=vault",
        "--write=deny"
      ]
    }
  }
}

Run the Gateway Manually

kosmokrator mcp:serve --integration=vault --write=deny

Why Use KosmoKrator Here

Scoped tools

Expose only HashiCorp Vault instead of a broad multi-service tool list.

Local credentials

Reuse credentials already configured for the KosmoKrator CLI and Lua runtime.

Write policy

Start read-only, then opt into ask or allow for trusted workspaces.

HashiCorp Vault Tools Visible to Claude Code

Claude Code sees stable MCP tool names generated from the HashiCorp Vault integration catalog.

MCP toolSource functionTypeDescription
integration__vault__vault_list_secrets vault.vault_list_secrets Read List secrets at a given path in a HashiCorp Vault KV v2 secrets engine. Returns the keys (directory entries) at the specified path.
integration__vault__vault_get_secret vault.vault_get_secret Read Get the latest version of a secret from a HashiCorp Vault KV v2 secrets engine. Optionally specify a version number to retrieve a specific version.
integration__vault__vault_create_secret vault.vault_create_secret Write Create or update a secret in a HashiCorp Vault KV v2 secrets engine. Provide the secret path and a key-value data object.
integration__vault__vault_delete_secret vault.vault_delete_secret Write Permanently delete all versions and metadata of a secret from a HashiCorp Vault KV v2 secrets engine. This action is irreversible.
integration__vault__vault_list_policies vault.vault_list_policies Read List all ACL policies configured in HashiCorp Vault. Returns an array of policy names.
integration__vault__vault_get_policy vault.vault_get_policy Read Get details of a specific ACL policy in HashiCorp Vault, including its name and HCL rules.
integration__vault__vault_get_current_user vault.vault_get_current_user Read Look up the current Vault token's information, including display name, policies, TTL, and metadata.

Related HashiCorp Vault Pages

HashiCorp Vault CLIUse direct JSON commands instead of MCP discovery. HashiCorp Vault MCPFull gateway reference and MCP tool names. KosmoKrator for Claude CodeClient-level gateway setup.