HashiCorp Vault MCP Server for Cloudflare Workers
Test HashiCorp Vault tools directly in your browser. Select a tool and provide inputs to see the results.
Create a free account to test HashiCorp Vault tools interactively. No credit card required.
vault_identity_read_groupRead an identity group by ID.
vault_totp_create_keyCreate or update a TOTP key.
vault_identity_read_group_by_nameRead an identity group by name.
vault_kubernetes_write_configConfigure the Kubernetes auth method.
vault_list_token_rolesList all token roles.
vault_kubernetes_list_rolesList all Kubernetes auth roles.
vault_rabbitmq_delete_roleDelete a RabbitMQ role.
vault_cert_list_crlsList all CRLs.
vault_disable_secrets_engineDisable a secrets engine. WARNING: This will revoke all secrets from this engine.
vault_delete_token_roleDelete a token role.
vault_totp_list_keysList all TOTP keys.
vault_unwrapUnwrap a wrapping token to retrieve the wrapped data.
vault_cert_list_certsList all certificate roles.
vault_get_token_roleGet configuration for a token role.
vault_lookup_wrappingLook up information about a wrapping token without unwrapping it.
vault_rewrapRewrap a wrapping token with a new token.
vault_cubbyhole_writeWrite a secret to cubbyhole storage (token-isolated).
vault_cubbyhole_deleteDelete a secret from cubbyhole storage.
vault_cubbyhole_listList secrets in cubbyhole storage.
vault_cert_read_certRead a certificate role.
vault_cert_create_certCreate or update a certificate role.
vault_approle_list_secret_idsList all Secret ID accessors for an AppRole role.
vault_aws_get_static_credentialsGet current credentials for an AWS static role.
vault_cert_delete_certDelete a certificate role.
vault_cert_read_configRead the TLS Certificate auth method configuration.
vault_approle_list_rolesList all AppRole roles.
vault_approle_read_roleRead configuration of an AppRole role.
vault_db_list_connectionsList all database connections configured in the Database secrets engine.
vault_db_read_connectionRead configuration of a database connection.
vault_approle_create_roleCreate or update an AppRole role.
vault_approle_delete_roleDelete an AppRole role.
vault_approle_get_role_idGet the Role ID for an AppRole role.
vault_approle_set_role_idSet a custom Role ID for an AppRole role.
vault_approle_generate_secret_idGenerate a new Secret ID for an AppRole role.
vault_approle_lookup_secret_idLook up a Secret ID by its value.
vault_approle_destroy_secret_idDestroy a Secret ID.
vault_approle_loginLogin using AppRole credentials to obtain a token.
vault_aws_read_root_configRead the AWS root configuration (credentials are not returned).
vault_aws_write_root_configConfigure the root credentials for AWS.
vault_aws_rotate_rootRotate the root credentials for AWS.
vault_aws_read_lease_configRead the lease configuration for AWS credentials.
vault_aws_write_lease_configConfigure the lease settings for AWS credentials.
vault_aws_list_rolesList all AWS roles.
vault_aws_read_roleRead an AWS role configuration.
vault_github_write_configConfigure the GitHub auth method.
vault_aws_create_roleCreate or update an AWS role.
vault_aws_delete_roleDelete an AWS role.
vault_aws_generate_credentialsGenerate AWS credentials for a role.
vault_aws_generate_sts_credentialsGenerate AWS STS credentials for a role.
vault_aws_list_static_rolesList all AWS static roles.
vault_aws_read_static_roleRead an AWS static role configuration.
vault_aws_create_static_roleCreate or update an AWS static role.
vault_aws_delete_static_roleDelete an AWS static role.
vault_cert_write_configConfigure the TLS Certificate auth method.
vault_cert_read_crlRead a CRL.
vault_cert_write_crlCreate or update a CRL.
vault_cert_delete_crlDelete a CRL.
vault_cert_loginLogin using a TLS client certificate. Note: The client certificate must be provided at the TLS layer.
vault_consul_read_access_configRead the Consul access configuration.
vault_consul_write_access_configConfigure the Consul access credentials.
vault_consul_list_rolesList all Consul roles.
vault_consul_read_roleRead a Consul role.
vault_consul_create_roleCreate or update a Consul role.
vault_consul_delete_roleDelete a Consul role.
vault_consul_generate_credentialsGenerate Consul credentials (ACL token) for a role.
vault_cubbyhole_readRead a secret from cubbyhole storage (token-isolated).
vault_github_list_teamsList all GitHub team mappings.
vault_db_create_connectionCreate or update a database connection.
vault_db_delete_connectionDelete a database connection.
vault_db_reset_connectionReset a database connection by closing and reconnecting.
vault_db_rotate_rootRotate the root credentials for a database connection.
vault_db_list_rolesList all dynamic roles in the Database secrets engine.
vault_db_read_roleRead configuration of a dynamic database role.
vault_db_create_roleCreate or update a dynamic database role.
vault_db_delete_roleDelete a dynamic database role.
vault_db_generate_credentialsGenerate dynamic database credentials for a role.
vault_db_list_static_rolesList all static roles in the Database secrets engine.
vault_db_read_static_roleRead configuration of a static database role.
vault_db_create_static_roleCreate or update a static database role.
vault_db_delete_static_roleDelete a static database role.
vault_db_get_static_credentialsGet current credentials for a static role.
vault_db_rotate_static_roleManually rotate the password for a static role.
vault_github_read_configRead the GitHub auth method configuration.
vault_github_read_teamRead a GitHub team mapping.
vault_github_write_teamCreate or update a GitHub team mapping.
vault_github_delete_teamDelete a GitHub team mapping.
vault_github_list_usersList all GitHub user mappings.
vault_github_read_userRead a GitHub user mapping.
vault_github_write_userCreate or update a GitHub user mapping.
vault_github_delete_userDelete a GitHub user mapping.
vault_github_loginLogin using a GitHub personal access token.
vault_identity_list_entitiesList all identity entities by ID.
vault_identity_list_entities_by_nameList all identity entities by name.
vault_identity_create_entityCreate a new identity entity.
vault_identity_read_entityRead an identity entity by ID.
vault_identity_read_entity_by_nameRead an identity entity by name.
vault_identity_update_entityUpdate an identity entity.
vault_identity_delete_entityDelete an identity entity and all its aliases.
vault_identity_merge_entitiesMerge multiple entities into one.
vault_identity_list_entity_aliasesList all entity aliases.
vault_identity_create_entity_aliasCreate an entity alias.
vault_identity_read_entity_aliasRead an entity alias.
vault_identity_update_entity_aliasUpdate an entity alias.
vault_identity_delete_entity_aliasDelete an entity alias.
vault_identity_list_groupsList all identity groups by ID.
vault_identity_list_groups_by_nameList all identity groups by name.
vault_identity_create_groupCreate an identity group.
vault_identity_update_groupUpdate an identity group.
vault_identity_delete_groupDelete an identity group.
vault_identity_list_group_aliasesList all group aliases.
vault_identity_create_group_aliasCreate a group alias (for external groups).
vault_identity_read_group_aliasRead a group alias.
vault_identity_update_group_aliasUpdate a group alias.
vault_identity_delete_group_aliasDelete a group alias.
vault_jwt_read_configRead the JWT/OIDC auth method configuration.
vault_jwt_write_configConfigure the JWT/OIDC auth method.
vault_jwt_list_rolesList all JWT/OIDC roles.
vault_jwt_read_roleRead a JWT/OIDC role configuration.
vault_jwt_create_roleCreate or update a JWT/OIDC role.
vault_jwt_delete_roleDelete a JWT/OIDC role.
vault_jwt_loginLogin using a JWT to obtain a Vault token.
vault_oidc_get_auth_urlGet the OIDC authorization URL for browser-based login.
vault_kubernetes_read_configRead the Kubernetes auth method configuration.
vault_kubernetes_read_roleRead a Kubernetes auth role.
vault_kubernetes_create_roleCreate or update a Kubernetes auth role.
vault_kubernetes_delete_roleDelete a Kubernetes auth role.
vault_kubernetes_loginLogin using a Kubernetes service account JWT.
vault_kv_readRead a secret from KV v2 secrets engine.
vault_kv_writeWrite a secret to KV v2 secrets engine.
vault_kv_deleteDelete the latest version of a secret (soft delete in KV v2).
vault_kv_delete_versionsDelete specific versions of a secret (soft delete).
vault_kv_undeleteUndelete (restore) soft-deleted versions of a secret.
vault_kv_destroyPermanently destroy versions of a secret (cannot be recovered).
vault_kv_listList secrets at a path in KV v2 engine.
vault_kv_read_metadataRead metadata for a secret including version history.
vault_kv_write_metadataUpdate metadata for a secret.
vault_kv_delete_metadataDelete all versions and metadata for a secret permanently.
vault_kv_read_configRead the configuration of a KV v2 secrets engine.
vault_kv_write_configConfigure a KV v2 secrets engine.
vault_kv_v1_readRead a secret from KV v1 secrets engine.
vault_kv_v1_writeWrite a secret to KV v1 secrets engine.
vault_kv_v1_deleteDelete a secret from KV v1 secrets engine.
vault_kv_v1_listList secrets at a path in KV v1 engine.
vault_ldap_read_configRead the LDAP auth method configuration.
vault_ldap_write_configConfigure the LDAP auth method.
vault_ldap_list_groupsList all LDAP group mappings.
vault_ldap_read_groupRead an LDAP group mapping.
vault_ldap_write_groupCreate or update an LDAP group mapping.
vault_ldap_delete_groupDelete an LDAP group mapping.
vault_ldap_list_usersList all LDAP user mappings.
vault_ldap_read_userRead an LDAP user mapping.
vault_ldap_write_userCreate or update an LDAP user mapping.
vault_ldap_delete_userDelete an LDAP user mapping.
vault_ldap_loginLogin using LDAP credentials.
vault_lookup_leaseLook up information about a lease.
vault_renew_leaseRenew a lease to extend its validity.
vault_revoke_leaseRevoke a lease immediately.
vault_revoke_lease_prefixRevoke all leases under a prefix. Requires sudo capability.
vault_pki_issue_certificateIssue a new certificate using a PKI role.
vault_pki_sign_certificateSign a CSR using a PKI role.
vault_pki_revoke_certificateRevoke a certificate by serial number.
vault_pki_list_certificatesList all issued certificate serial numbers.
vault_pki_read_certificateRead a certificate by serial number.
vault_pki_get_caGet the CA certificate.
vault_pki_get_ca_chainGet the CA certificate chain.
vault_pki_list_issuersList all issuers in the PKI engine.
vault_pki_read_issuerRead details of a specific issuer.
vault_pki_list_rolesList all PKI roles.
vault_pki_read_roleRead configuration of a PKI role.
vault_pki_create_roleCreate or update a PKI role.
vault_pki_delete_roleDelete a PKI role.
vault_pki_read_urls_configRead the URLs configuration for the PKI engine.
vault_pki_write_urls_configConfigure URLs for the PKI engine.
vault_pki_rotate_crlRotate the Certificate Revocation List.
vault_unsealProvide an unseal key to unseal Vault. Multiple keys may be required based on threshold.
vault_pki_tidyTidy up the PKI backend by removing expired certificates.
vault_rabbitmq_write_connection_configConfigure the RabbitMQ connection.
vault_rabbitmq_write_lease_configConfigure the RabbitMQ lease settings.
vault_rabbitmq_list_rolesList all RabbitMQ roles.
vault_rabbitmq_read_roleRead a RabbitMQ role.
vault_rabbitmq_create_roleCreate or update a RabbitMQ role.
vault_rabbitmq_generate_credentialsGenerate RabbitMQ credentials for a role.
vault_ssh_list_rolesList all SSH roles.
vault_ssh_read_roleRead configuration of an SSH role.
vault_ssh_create_roleCreate or update an SSH role.
vault_ssh_delete_roleDelete an SSH role.
vault_ssh_generate_credentialsGenerate SSH credentials (OTP or dynamic key) for a role.
vault_ssh_sign_keySign an SSH public key using a CA role.
vault_ssh_verify_otpVerify an SSH OTP.
vault_ssh_read_ca_configRead the SSH CA public key.
vault_ssh_write_ca_configConfigure the SSH CA.
vault_ssh_delete_ca_configDelete the SSH CA configuration.
vault_healthGet Vault health status including initialization, seal state, and version.
vault_seal_statusGet Vault seal status including key shares and threshold.
vault_leaderGet Vault cluster leader information for HA deployments.
vault_sealSeal the Vault. WARNING: This will make Vault unavailable until unsealed.
vault_initInitialize a new Vault instance. Only works on uninitialized Vault.
vault_list_mountsList all mounted secrets engines.
vault_enable_secrets_engineEnable a new secrets engine at the specified path.
vault_tune_mountTune configuration of a mounted secrets engine.
vault_list_auth_methodsList all enabled authentication methods.
vault_enable_auth_methodEnable a new authentication method at the specified path.
vault_disable_auth_methodDisable an authentication method.
vault_list_policiesList all ACL policies.
vault_get_policyGet the rules for a specific policy.
vault_create_policyCreate or update an ACL policy.
vault_delete_policyDelete an ACL policy.
vault_list_audit_devicesList all enabled audit devices.
vault_enable_audit_deviceEnable a new audit device.
vault_disable_audit_deviceDisable an audit device.
vault_check_capabilitiesCheck what capabilities a token has on given paths.
vault_lookup_selfLook up information about the current token.
vault_lookup_tokenLook up information about a specific token.
vault_create_tokenCreate a new token with specified policies and settings.
vault_renew_selfRenew the current token.
vault_renew_tokenRenew a specific token.
vault_revoke_selfRevoke the current token and all its child tokens.
vault_revoke_tokenRevoke a specific token and all its child tokens.
vault_revoke_accessorRevoke a token using its accessor.
vault_list_accessorsList all token accessors. Requires sudo capability.
vault_create_token_roleCreate or update a token role.
vault_totp_read_keyRead a TOTP key configuration.
vault_totp_delete_keyDelete a TOTP key.
vault_totp_generate_codeGenerate a TOTP code for a key.
vault_totp_validate_codeValidate a TOTP code.
vault_transit_create_keyCreate a new encryption key in the Transit secrets engine.
vault_transit_read_keyRead information about a Transit encryption key.
vault_transit_list_keysList all keys in the Transit secrets engine.
vault_transit_delete_keyDelete a Transit encryption key. Key must have deletion_allowed=true.
vault_transit_update_key_configUpdate configuration of a Transit encryption key.
vault_transit_rotate_keyRotate a Transit encryption key to a new version.
vault_transit_encryptEncrypt plaintext using a Transit encryption key.
vault_transit_decryptDecrypt ciphertext using a Transit encryption key.
vault_transit_rewrapRewrap ciphertext with the latest key version.
vault_transit_generate_data_keyGenerate a data encryption key wrapped by a Transit key.
vault_transit_generate_randomGenerate cryptographically secure random bytes.
vault_transit_hashHash data using a cryptographic hash function.
vault_transit_hmacGenerate HMAC for data using a Transit key.
vault_transit_signSign data using a Transit signing key.
vault_transit_verifyVerify a signature using a Transit signing key.
vault_userpass_list_usersList all userpass users.
vault_userpass_read_userRead a userpass user configuration.
vault_userpass_create_userCreate or update a userpass user.
vault_userpass_delete_userDelete a userpass user.
vault_userpass_update_passwordUpdate a user password.
vault_userpass_update_policiesUpdate policies for a user.
vault_userpass_loginLogin using userpass credentials to obtain a token.
vault_wrapWrap arbitrary data in a single-use wrapping token.
vault_sys_generate_randomGenerate cryptographically secure random bytes.
vault_sys_hashHash data using a cryptographic hash function.
vault_identity_read_group{
"id": "example_id"
}vault_totp_create_key{}vault_identity_read_group_by_name{
"name": "example_name"
}