Security model for Vault MCP server

Uderstanding the security model for the Vault MCP server when operating the server locally using stdio or streamable HTTP helps you safely integrate local AI agents with Vault tooling. The Vault MCP server can help keep tool execution safe and controlled, protect sensitive operations from accidental misuse or injection, contrain LLM behavior, and make LLM behavior auditable prior to application.

Liability disclaimer

Depending on the query, the MCP server may expose certain Vault data, including Vault secrets, to MCP clients and LLMs interacting with the server. Do not use the MCP server with untrusted MCP clients or LLMs.

Your use of third-party MCP clients and LLMs is subject solely to the terms of use for those MCP servers and LLMs. IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP clients and LLMs, and may not be able to provide support to resolve issues caused by the third party tools.

Important concepts

Model Context Protocol (MCP) - A protocol allowing language models (or agents) to call tools programmatically through structured and standardized definitions.
MCP host - An AI application or environment in which AI-driven tasks are performed that operates the MCP client. (e.g. Claude Desktop).
MCP client - The MCP client handles discovery and communication between the MCP host and the MCP server by translating model prompts into executable actions.
MCP server - The service called by the MCP client to execute tools, resources, and prompts. The MCP server provides a server or tool manifest that allows for dynamic discovery of available capabilities.
MCP tool - A server-defined executable function or operation (e.g. "list", "write", "delete") with defined inputs and outputs callable by clients.
MCP transport - The underlying communication protocol used to send and receive message with JSON-RPC 2.0.
- stdio allows direct tool invocation with the standard input/output pipe.
- Streamable HTTP exposes a local server (e.g., 127.0.0.1:<port>) to receive and respond to MCP tool calls.

Threat model

Hallucination - AI hallucinations, or the generation of false information, stem from insufficient training data, flawed model assumptions, and biased datasets. Hallucinations pose serious risks in critical applications where accuracy is vital for correct diagnoses and sound decisions. You shuould always validate the output of LLM models prior to applying any changes in their environment.

Prompt injection - Improper validation or sanitization of user input can allow attackers to inject malicious instructions that the MCP server will execute. Injection can lead to code execution, Server Side Request Forgery (SSRF), and various other security breaches.
Tool poisoning - Tool poisoning occurs when the MCP server inadvertently executes hidden instructions within comprehensive tool descriptions, enabling attackers to instigate unwanted or damaging outcomes.
Rug pull attacks - Changing the available tools and descriptions for a remotely accessible MCP server after deployment can enable malicious behavior that was not present when you intially approved the available tool.
Tool shadowing - When you have multiple MCP servers connected, a malicious server can override tools from a trusted server and lead to potential security breaches.

Threat model exclusions

The following are not part of the threat model for the Vault MCP server:

Foundational model - Concerns related to the underlying AI models, training data, and inherent vulnerabilities.