Integration

HashiCorp Vault integration

HashiCorp Vault REST API for secrets management and data protection. Store and access secrets, manage encryption keys, generate dynamic credentials, and control access with fine-grained policies for application security.

Connect HashiCorp Vault How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in HashiCorp Vault.Built from the 31 HashiCorp Vault tools below, on the connection you add once.

Common HashiCorp Vault use cases

automate policy management
automate auth method management
automate token management
automate kv2 secret management
automate data transit management
automate secrets engine management
get health programmatically
get policy programmatically
list mount programmatically
seal vault programmatically

What you can do with HashiCorp Vault

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Kv2 secret, 4 operations

delete_kv2_secretDelete kv2 secretDELETEDelete the latest version of a secret in the KV v2 secrets engine. The secret metadata and older versions are retained and can be recovered via undelete.
list_kv2_secretsList kv2 secretsGETList all secret keys at the specified path prefix in the KV v2 secrets engine. Returns key names and subfolders. Uses the LIST HTTP method modeled as GET with list=true.
read_kv2_secretRead kv2 secretGETRead a secret from the KV v2 secrets engine at the specified mount and path. Returns the secret data along with metadata such as version, creation time, and deletion status.
write_kv2_secretWrite kv2 secretPOSTWrite or update a secret in the KV v2 secrets engine. Creates a new version of the secret while preserving previous versions for rollback.

Policy, 4 operations

create_or_update_policyCreate or update policyPUTCreate or update an ACL policy with the specified name. Policy rules are written in HashiCorp Configuration Language (HCL) and define path-level capabilities.
delete_policyDelete policyDELETEDelete the ACL policy with the specified name. Tokens associated with this policy will lose the permissions it granted.
get_policyGet policyGETRetrieve the rules and HCL definition of a specific ACL policy by name.
list_policiesList policiesGETLists all ACL policies defined in Vault. Policies control what paths and operations a token is allowed to access.

Auth method, 3 operations

disable_auth_methodDisable auth methodDELETEDisable the auth method at the specified path. All tokens generated by this method are revoked.
enable_auth_methodEnable auth methodPOSTEnable a new authentication method at the specified path. Common methods include userpass, approle, aws, kubernetes, jwt, and ldap.
list_auth_methodsList auth methodsGETLists all the enabled authentication methods in the Vault along with their configurations and accessor values.

Token, 3 operations

create_tokenCreate tokenPOSTCreate a new Vault token. The created token inherits a subset of the parent token's policies. Useful for creating service-specific tokens with restricted capabilities.
lookup_self_tokenLookup self tokenGETLook up information about the current token being used, including its policies, TTL, accessor, and metadata. Does not require elevated privileges.
revoke_tokenRevoke tokenPOSTRevoke a Vault token and all tokens derived from it (child tokens). All secrets leased by the token are also revoked.

Vault, 3 operations

initialize_vaultInitialize vaultPOSTInitialize a new Vault instance. Only works on an uninitialized Vault. Returns the initial root token and unseal keys which must be stored securely.
seal_vaultSeal vaultPOSTSeals the Vault server. After sealing, all access to secrets is blocked until the Vault is unsealed again. Requires a token with sudo privileges.
unseal_vaultUnseal vaultPOSTProvide an unseal key share to progress toward unsealing the Vault. Must be called multiple times with different key shares until the threshold is reached.

Data transit, 2 operations

decrypt_data_transitDecrypt data transitPOSTDecrypt ciphertext using a named encryption key in the Transit secrets engine. Returns the original base64-encoded plaintext.
encrypt_data_transitEncrypt data transitPOSTEncrypt plaintext data using a named encryption key in the Transit secrets engine. Returns a ciphertext that can only be decrypted by Vault using the same key.

Kv1 secret, 2 operations

read_kv1_secretRead kv1 secretGETRead a secret from the KV v1 secrets engine at the specified mount and path. Returns the raw secret data without versioning.
write_kv1_secretWrite kv1 secretPOSTWrite or overwrite a secret in the KV v1 secrets engine. Unlike KV v2, this does not maintain version history - it replaces the existing secret entirely.

Secrets engine, 2 operations

disable_secrets_engineDisable secrets engineDELETEDisable the secrets engine at the specified mount path. All secrets stored under this path are revoked and the path is removed.
enable_secrets_engineEnable secrets enginePOSTEnable a new secrets engine at the specified path. Vault supports many secret engine types such as kv, database, transit, aws, pki, and more.

Approle auth, 1 operation

approle_loginApprole loginPOSTAuthenticate using the AppRole auth method with a Role ID and Secret ID. Designed for machine and application authentication. Returns a Vault token on success.

Database credential, 1 operation

generate_database_credentialsGenerate database credentialsGETGenerate dynamic database credentials (username and password) for the specified database role. Credentials are temporary, automatically rotated, and expire after the configured TTL.

Health, 1 operation

get_healthGet healthGETReturns the health status of the Vault server. Useful for load balancer health checks and monitoring. Returns 200 if initialized, unsealed, and active.

Mount, 1 operation

list_mountsList mountsGETLists all the mounted secrets engines in the Vault along with their configurations, accessor values, and local/replication settings.

Seal status, 1 operation

get_seal_statusGet seal statusGETReturns the seal status of the Vault server, including whether it is sealed, the number of shares required to unseal, and how many unseal keys have been provided.

Self token, 1 operation

renew_self_tokenRenew self tokenPOSTRenew the TTL of the current token. The token must be renewable and must not have expired. Extends the token's validity by the increment or its original TTL.

Transit key, 1 operation

create_transit_keyCreate transit keyPOSTCreate a new named encryption key in the Transit secrets engine. Keys can be used for encryption, decryption, signing, verification, and HMAC operations.

Userpass auth, 1 operation

userpass_loginUserpass loginPOSTAuthenticate using the Userpass auth method with a username and password. Returns a Vault token on success that can be used for subsequent API calls.

Use HashiCorp Vault from Claude Code, Cursor or Codex

Connect HashiCorp Vault in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its HashiCorp Vault operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect HashiCorp Vault

Create your workspace
Sign up free. Nothing to install.
Connect HashiCorp Vault once
Add your HashiCorp Vault connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

HashiCorp Vault integration FAQ

What can you do with the HashiCorp Vault integration?

LiveContext exposes 31 operations on HashiCorp Vault, covering kv2 secret, policy, auth method and token. Common uses include automate policy management, automate auth method management and automate token management.