What can you do with the HashiCorp Vault integration?

LiveContext exposes 31 operations on HashiCorp Vault, covering kv2 secret, policy, auth method and token. Common uses include automate policy management, automate auth method management and automate token management.

LiveContext

All integrations

HashiCorp Vault integration

HashiCorp Vault REST API for secrets management and data protection. Store and access secrets, manage encryption keys, generate dynamic credentials, and control access with fine-grained policies for application security.

31 toolsAPI keyAPI docs

Connect HashiCorp Vault How integrations work

Common HashiCorp Vault use cases

automate policy management
automate auth method management
automate token management
automate kv2 secret management
automate data transit management
automate secrets engine management
get health programmatically
get policy programmatically
list mount programmatically
seal vault programmatically

What you can do with HashiCorp Vault

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Kv2 secret, 4 operations

DELETEdelete_kv2_secret
Delete the latest version of a secret in the KV v2 secrets engine. The secret metadata and older versions are retained and can be recovered via undelete.
GETlist_kv2_secrets
List all secret keys at the specified path prefix in the KV v2 secrets engine. Returns key names and subfolders. Uses the LIST HTTP method modeled as GET with list=true.
GETread_kv2_secret
Read a secret from the KV v2 secrets engine at the specified mount and path. Returns the secret data along with metadata such as version, creation time, and deletion status.
POSTwrite_kv2_secret
Write or update a secret in the KV v2 secrets engine. Creates a new version of the secret while preserving previous versions for rollback.

Policy, 4 operations

PUTcreate_or_update_policy
Create or update an ACL policy with the specified name. Policy rules are written in HashiCorp Configuration Language (HCL) and define path-level capabilities.
DELETEdelete_policy
Delete the ACL policy with the specified name. Tokens associated with this policy will lose the permissions it granted.
GETget_policy
Retrieve the rules and HCL definition of a specific ACL policy by name.
GETlist_policies
Lists all ACL policies defined in Vault. Policies control what paths and operations a token is allowed to access.

Auth method, 3 operations

DELETEdisable_auth_method
Disable the auth method at the specified path. All tokens generated by this method are revoked.
POSTenable_auth_method
Enable a new authentication method at the specified path. Common methods include userpass, approle, aws, kubernetes, jwt, and ldap.
GETlist_auth_methods
Lists all the enabled authentication methods in the Vault along with their configurations and accessor values.

Token, 3 operations

POSTcreate_token
Create a new Vault token. The created token inherits a subset of the parent token's policies. Useful for creating service-specific tokens with restricted capabilities.
GETlookup_self_token
Look up information about the current token being used, including its policies, TTL, accessor, and metadata. Does not require elevated privileges.
POSTrevoke_token
Revoke a Vault token and all tokens derived from it (child tokens). All secrets leased by the token are also revoked.

Vault, 3 operations

POSTinitialize_vault
Initialize a new Vault instance. Only works on an uninitialized Vault. Returns the initial root token and unseal keys which must be stored securely.
POSTseal_vault
Seals the Vault server. After sealing, all access to secrets is blocked until the Vault is unsealed again. Requires a token with sudo privileges.
POSTunseal_vault
Provide an unseal key share to progress toward unsealing the Vault. Must be called multiple times with different key shares until the threshold is reached.

Data transit, 2 operations

POSTdecrypt_data_transit
Decrypt ciphertext using a named encryption key in the Transit secrets engine. Returns the original base64-encoded plaintext.
POSTencrypt_data_transit
Encrypt plaintext data using a named encryption key in the Transit secrets engine. Returns a ciphertext that can only be decrypted by Vault using the same key.

Kv1 secret, 2 operations

GETread_kv1_secret
Read a secret from the KV v1 secrets engine at the specified mount and path. Returns the raw secret data without versioning.
POSTwrite_kv1_secret
Write or overwrite a secret in the KV v1 secrets engine. Unlike KV v2, this does not maintain version history - it replaces the existing secret entirely.

Secrets engine, 2 operations

DELETEdisable_secrets_engine
Disable the secrets engine at the specified mount path. All secrets stored under this path are revoked and the path is removed.
POSTenable_secrets_engine
Enable a new secrets engine at the specified path. Vault supports many secret engine types such as kv, database, transit, aws, pki, and more.

Approle auth, 1 operation

POSTapprole_login
Authenticate using the AppRole auth method with a Role ID and Secret ID. Designed for machine and application authentication. Returns a Vault token on success.

Database credential, 1 operation

GETgenerate_database_credentials
Generate dynamic database credentials (username and password) for the specified database role. Credentials are temporary, automatically rotated, and expire after the configured TTL.

Health, 1 operation

GETget_health
Returns the health status of the Vault server. Useful for load balancer health checks and monitoring. Returns 200 if initialized, unsealed, and active.

Mount, 1 operation

GETlist_mounts
Lists all the mounted secrets engines in the Vault along with their configurations, accessor values, and local/replication settings.

Seal status, 1 operation

GETget_seal_status
Returns the seal status of the Vault server, including whether it is sealed, the number of shares required to unseal, and how many unseal keys have been provided.

Self token, 1 operation

POSTrenew_self_token
Renew the TTL of the current token. The token must be renewable and must not have expired. Extends the token's validity by the increment or its original TTL.

Transit key, 1 operation

POSTcreate_transit_key
Create a new named encryption key in the Transit secrets engine. Keys can be used for encryption, decryption, signing, verification, and HMAC operations.

Userpass auth, 1 operation

POSTuserpass_login
Authenticate using the Userpass auth method with a username and password. Returns a Vault token on success that can be used for subsequent API calls.

Use HashiCorp Vault from Claude Code, Cursor or Codex

Connect HashiCorp Vault in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its HashiCorp Vault operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect HashiCorp Vault

Create your workspace
Sign up free. Nothing to install.
Connect HashiCorp Vault once
Add your HashiCorp Vault connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

HashiCorp Vault integration FAQ

What can you do with the HashiCorp Vault integration?: LiveContext exposes 31 operations on HashiCorp Vault, covering kv2 secret, policy, auth method and token. Common uses include automate policy management, automate auth method management and automate token management.