Secrets management
## HashiCorp Vault MCP Server: Secrets Management at Scale The **HashiCorp Vault MCP Server** integrates enterprise secrets management into Google Antigravity, enabling secure storage, dynamic secrets generation, and encryption as a service for applications and infrastructure. ### Why HashiCorp Vault MCP? - **Secret storage** - Securely store and access sensitive credentials - **Dynamic secrets** - Generate short-lived credentials on demand - **Encryption service** - Encrypt and decrypt data without managing keys - **PKI management** - Issue and manage TLS certificates - **Identity integration** - Authenticate using various identity providers ### Key Features #### 1. Secret Management ```python # Store and retrieve secrets await mcp.call("vault", "write_secret", { "path": "secret/data/myapp/database", "data": { "username": "app_user", "password": "super_secret_password", "host": "db.example.com" } }) # Read secret secret = await mcp.call("vault", "read_secret", { "path": "secret/data/myapp/database" }) db_config = secret["data"]["data"] print(f"Connecting to {db_config[\"host\"]} as {db_config[\"username\"]}") ``` #### 2. Dynamic Database Credentials ```python # Generate dynamic database credentials creds = await mcp.call("vault", "generate_credentials", { "backend": "database", "role": "readonly-role" }) print(f"Username: {creds[\"username\"]}") print(f"Password: {creds[\"password\"]}") print(f"TTL: {creds[\"lease_duration\"]}s") # Use credentials (they auto-expire) conn = await connect_db( user=creds["username"], password=creds["password"] ) ``` #### 3. Transit Encryption ```python # Encrypt sensitive data encrypted = await mcp.call("vault", "encrypt", { "key_name": "my-encryption-key", "plaintext": "sensitive data to protect" }) print(f"Ciphertext: {encrypted[\"ciphertext\"]}") # Decrypt when needed decrypted = await mcp.call("vault", "decrypt", { "key_name": "my-encryption-key", "ciphertext": encrypted["ciphertext"] }) print(f"Plaintext: {decrypted[\"plaintext\"]}") ``` #### 4. PKI Certificate Management ```python # Issue TLS certificate cert = await mcp.call("vault", "issue_certificate", { "pki_path": "pki/issue/web-server", "common_name": "api.example.com", "alt_names": ["www.example.com"], "ttl": "720h" }) print(f"Certificate:\\n{cert[\"certificate\"]}") print(f"Private Key:\\n{cert[\"private_key\"]}") print(f"Expires: {cert[\"expiration\"]}") ``` ### Configuration ```json { "mcpServers": { "vault": { "command": "npx", "args": ["-y", "@anthropic/mcp-vault"], "env": { "VAULT_ADDR": "https://vault.company.com", "VAULT_TOKEN": "hvs.your-vault-token", "VAULT_NAMESPACE": "admin" } } } } ``` ### Use Cases **Application Secrets**: Store database credentials, API keys, and certificates securely. **Dynamic Access**: Generate short-lived credentials for databases and cloud providers. **Data Encryption**: Encrypt sensitive data at rest without managing encryption keys. **Certificate Automation**: Issue and rotate TLS certificates automatically. The HashiCorp Vault MCP Server transforms secrets management into a secure, automated workflow.
{
"mcpServers": {
"hashicorp-vault": {
"mcpServers": {
"vault": {
"env": {
"VAULT_ADDR": "https://vault.example.com",
"VAULT_TOKEN": "your-token"
},
"args": [
"-y",
"vault-mcp-server"
],
"command": "npx"
}
}
}
}
}