Vault FAQs

Question 1

What types of secrets can be managed with MCP Vault?

Accepted Answer

MCP Vault supports 14 different types of secrets, similar to a personal password manager. These include login credentials, API keys, SSH keys, credit cards, and secure notes, all with built-in versioning for auditing and rollback capabilities.

Question 2

How does MCP Vault ensure the security and availability of secrets?

Accepted Answer

It leverages OpenBao for encryption, stores unseal keys encrypted on S3 (never in plaintext on disk), and automates the entire lifecycle: unseal, seal, and periodic synchronization with S3. This ensures high availability and robust protection of secrets.

Question 3

Can I control who has access to specific secrets or vaults?

Accepted Answer

Absolutely. MCP Vault features granular access control policies, allowing administrators to define precise permissions for tools and vaults. These policies support wildcards and specific vault rules, enabling fine-grained management of access for various AI agents or teams.

Question 4

What is MCP Vault and its primary function?

Accepted Answer

MCP Vault is a server designed for AI agents and missions, providing a secure secrets management solution. It embeds OpenBao (a Linux Foundation fork of HashiCorp Vault) to handle robust cryptographic operations, essentially acting as a '1Password for AI agents'.

Question 5

How does MCP Vault enhance SSH security for AI agents?

Accepted Answer

It integrates an SSH Certificate Authority (CA) feature, providing isolated CAs for each vault. This allows for the issuance of ephemeral SSH certificates, significantly improving the security posture and access management for AI agents connecting to various systems.

Vault

Vault

Key Features

Use Cases

Key Features

Use Cases