MCP server best practices

Consider and follow these recommendations for securely using the Vault MCP server.

Ensure local-only server access

We recommend running the MCP Server locally (127.0.0.1) through the stdio or HTTP Streamable transport protocol to limit the exposure of your Vault environment to the public. The MCP server uses stdio by default. If you decide to host the service remotely, you should add additional security controls at the application and network level.

Enable CORS

The MCP server uses strict CORS mode by default which leaves the allowed origins list empty blocks all cross-origin requests unless you explicity configure the server to allow them. Be cautious when you edit the allowed origins to include the MCP Client and Vault server endpoints.

Protect authentication to Vault

We recommend configuring VAULT_SKIP_VERIFY to keep comminication with your Vault environment encrypted. Do not use a root or shared VAULT_TOKEN to connect to the MCP server. MCP end users should generate individual tokens with limited/minimally required permissions.

Enforce rate limiting

We recommend configuring the global and per session rate limiting to prevent overloading the MCP server or dependent resources such as the Vault instance through excessive requests.

Secure in-transit communication

If you choose to make your MCP server accessible remotely, configure a valid TLS certificate to protect in-transit communication of your data.

Disable privileged operations

We recommend setting ENABLE_VAULT_OPERATIONS to false to disable tools that performs privileged opperations if you want to prohibit the MCP server from creating, editing, or removing secrets in Vault.