KosmoKrator

productivity

HashiCorp Vault MCP Integration for Codex

Connect HashiCorp Vault to Codex through the local KosmoKrator MCP gateway with scoped tools, credentials, and write policy.

7 functions 5 read 2 write API token auth
Submit HashiCorp Vault feedback View package source

Connect HashiCorp Vault to Codex

Use KosmoKrator as a local MCP proxy for Codex so coding sessions can reach selected integrations with explicit write policy.

Register kosmo mcp:serve as a local stdio server and choose the integration allowlist. The gateway is local, scoped to this integration, and starts with --write=deny so Codex can inspect read-capable tools without receiving write access by default.

HashiCorp Vault MCP Config for Codex

Keep write access denied or ask-based unless the workspace is trusted.

{
  "mcpServers": {
    "kosmokrator-vault": {
      "type": "stdio",
      "command": "kosmo",
      "args": [
        "mcp:serve",
        "--integration=vault",
        "--write=deny"
      ]
    }
  }
}

Run the Gateway Manually

kosmokrator mcp:serve --integration=vault --write=deny

Why Use KosmoKrator Here

Scoped tools

Expose only HashiCorp Vault instead of a broad multi-service tool list.

Local credentials

Reuse credentials already configured for the KosmoKrator CLI and Lua runtime.

Write policy

Start read-only, then opt into ask or allow for trusted workspaces.

HashiCorp Vault Tools Visible to Codex

Codex sees stable MCP tool names generated from the HashiCorp Vault integration catalog.

MCP toolSource functionTypeDescription
integration__vault__vault_list_secrets vault.vault_list_secrets Read List secrets at a given path in a HashiCorp Vault KV v2 secrets engine. Returns the keys (directory entries) at the specified path.
integration__vault__vault_get_secret vault.vault_get_secret Read Get the latest version of a secret from a HashiCorp Vault KV v2 secrets engine. Optionally specify a version number to retrieve a specific version.
integration__vault__vault_create_secret vault.vault_create_secret Write Create or update a secret in a HashiCorp Vault KV v2 secrets engine. Provide the secret path and a key-value data object.
integration__vault__vault_delete_secret vault.vault_delete_secret Write Permanently delete all versions and metadata of a secret from a HashiCorp Vault KV v2 secrets engine. This action is irreversible.
integration__vault__vault_list_policies vault.vault_list_policies Read List all ACL policies configured in HashiCorp Vault. Returns an array of policy names.
integration__vault__vault_get_policy vault.vault_get_policy Read Get details of a specific ACL policy in HashiCorp Vault, including its name and HCL rules.
integration__vault__vault_get_current_user vault.vault_get_current_user Read Look up the current Vault token's information, including display name, policies, TTL, and metadata.

Related HashiCorp Vault Pages

HashiCorp Vault CLIUse direct JSON commands instead of MCP discovery. HashiCorp Vault MCPFull gateway reference and MCP tool names. KosmoKrator for CodexClient-level gateway setup.