Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 25 additions & 5 deletions content/vault/v1.20.x/content/docs/mcp-server/prompt-model.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ description: |-

This topic provides example prompts for helping you manage HashiCorp Vault after installing the Vault model context protocol (MCP) server. Refer to [Deploy the Vault MCP server](/vault/docs/tools/mcp-server/deploy) for instructions on how to deploy the server.

@include 'beta.mdx'
@include 'alerts/beta.mdx'

## Overview

Expand Down Expand Up @@ -80,6 +80,8 @@ The server performs the following operations:

#### Sample response

<CodeBlockConfig hideClipboard>

```text
Successfully stored database credentials in Vault:

Expand All @@ -96,6 +98,8 @@ or by reading the secret directly from Vault.
to read from this path while following the principle of least privilege.
```

</CodeBlockConfig>

### Set up PKI certificate authority

The following prompt creates a complete PKI infrastructure for SSL/TLS certificates:
Expand Down Expand Up @@ -148,6 +152,8 @@ The server performs multiple coordinated operations:

#### PKI setup response

<CodeBlockConfig hideClipboard>

```text
Successfully configured PKI infrastructure for example.com:

Expand Down Expand Up @@ -177,6 +183,8 @@ The PKI infrastructure is ready to issue certificates for:
- Both server and client authentication use cases
```

</CodeBlockConfig>

### List and audit secrets

The following prompt performs security auditing across Vault:
Expand Down Expand Up @@ -207,6 +215,8 @@ mounts exist and list the secrets in the main KV store.

#### Audit response

<CodeBlockConfig hideClipboard>

```text
# Vault Security Audit Report

Expand Down Expand Up @@ -240,6 +250,8 @@ secret/
**Mount Health**: All mounts operational ✅
```

</CodeBlockConfig>

### Issue SSL certificates for applications

The following prompt demonstrates certificate lifecycle management:
Expand Down Expand Up @@ -270,6 +282,8 @@ the existing PKI role.

#### Certificate response

<CodeBlockConfig hideClipboard>

```text
Successfully issued SSL certificate for api.internal.example.com:

Expand Down Expand Up @@ -308,6 +322,8 @@ MIIEvgIBADANBgkqhkiG9w0BAQ...
Certificate expires in 30 days - set up renewal automation.
```

</CodeBlockConfig>

### Delete and cleanup secrets

The following prompt demonstrates secure cleanup operations:
Expand Down Expand Up @@ -342,6 +358,8 @@ the entire legacy mount if it's empty.

#### Cleanup response

<CodeBlockConfig hideClipboard>

```text
Cleanup operations completed successfully:

Expand All @@ -364,23 +382,25 @@ Would you like me to remove the empty legacy path structure
or keep it for future use?
```

## Best Practices for Vault MCP Prompts
</CodeBlockConfig>

## Best practices for Vault MCP prompts

### Effective Prompt Structure
### Effective prompt structure

- **Be Specific**: Use exact mount paths and secret names
- **Include Context**: Mention the purpose (app credentials, certificates, etc.)
- **Specify Requirements**: TTL values, certificate parameters, security policies
- **Request Validation**: Ask for confirmation of operations before execution

### Security Considerations
### Security considerations

- **Principle of Least Privilege**: Request minimal necessary permissions
- **Audit Trail**: Ensure operations are logged and traceable
- **Secret Lifecycle**: Consider rotation, expiration, and cleanup
- **Access Patterns**: Design secrets structure for application access patterns

### Common Use Cases
### Common use cases

- **Application Secrets**: Database credentials, API keys, service tokens
- **PKI Management**: Certificate authorities, SSL certificates, key rotation
Expand Down
4 changes: 2 additions & 2 deletions content/vault/v1.20.x/content/docs/mcp-server/reference.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ You can set one of the following transport protocols when starting the MCP serve
| `stdio` | Local development and direct integration with MCP clients | Uses standard input/output for JSON-RPC message communication | Automatically used when no specific transport mode is configured |
| `streamable-http`| Distributed setups, internal environments | HTTP-based transport with support for both direct HTTP requests | Enable by setting `TRANSPORT_MODE=streamable-http` |

## HTTP Mode Configuration
## HTTP mode configuration

At this stage, the MCP server is intended for local use only. If using the StreamableHTTP transport in production, always configure the MCP_ALLOWED_ORIGINS environment variable to restrict access to trusted origins only.
This helps prevent DNS rebinding attacks and other cross-origin vulnerabilities.
Expand All @@ -72,7 +72,7 @@ In HTTP mode, Vault configuration can be provided through multiple methods (**in

You can set the following environment variables to configure the server behavior.

| Variable | Purpose | Default Value | Example | Options |
| Variable | Purpose | Default value | Example | Options |
|--------------------------|--------------------------------------------------------------|---------------------------|--------------------------------|-----------------------------------------|
| `VAULT_ADDR` | Vault server address | `http://127.0.0.1:8200` | `http://vault.example.com:8200`| Any valid Vault server address |
| `VAULT_TOKEN` | Vault authentication token (required) | — | `hvs.xxxxxxxx` | Any valid Vault token |
Expand Down
6 changes: 3 additions & 3 deletions content/vault/v1.20.x/data/docs-nav-data.json
Original file line number Diff line number Diff line change
Expand Up @@ -1981,19 +1981,19 @@
"path": "mcp-server/overview"
},
{
"title": "Deploy Server",
"title": "Deploy server",
"path": "mcp-server/deploy"
},
{
"title": "Prompt Model",
"title": "Prompt model",
"path": "mcp-server/prompt-model"
},
{
"title": "Reference",
"path": "mcp-server/reference"
},
{
"title": "Security Model",
"title": "Security model",
"path": "mcp-server/security-model"
}
]
Expand Down
Loading