Example prompt: List and audit secrets

Beta feature

Beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production deployments of Vault.

Use the following example as a guide to help you write your own prompt to list the current secret mounts in Vault, the key secrets in kv, and perform an initial security audit.

Assumptions

You have a running HashiCorp Vault instance.
You have the Vault MCP server running.
You have a valid Vault authentication token with appropriate permissions for the resource you want to modify.
You have a local MCP client configured (e.g., Claude for Desktop, VS Code).
You have a least one secret engine plugin enabled at /secret.
You have the kv plugin enabled.

Prompt

I need to audit all secrets in my Vault. Show me what 
mounts exist and list the secrets in the main KV store.

Expected workflow

The MCP server performs the following operations:

List all mounts: Discovers available secrets engines
List secrets in KV: Enumerates stored secrets
Security analysis: Provides audit recommendations

Associated API request objects

Request object to list the available secrets plugins:
```
{
  "mount": "secret", 
  "path": ""
}
```

Sample response

Disclaimer

Example responses come from using the Vault MCP server with ChatGPT 4.1 in GitHub Copilot on VS Code. Your responses may vary.

# Vault Security Audit Report

## Available Mounts

| Mount Path | Type     | Description               |
|------------|----------|---------------------------|
| `secret/`. | kv-v2    | Key-Value secrets engine  |
| `pki_root/`| pki      | PKI Certificate Authority |
| `sys/`     | system   | Vault system backend.     |
| `identity/`| identity | Identity secrets engine   |

## Secrets Inventory (secret/ mount)

secret/
├── myapp/
│   ├── database
│   ├── api-keys  
│   └── certificates
├── shared/
│   └── service-accounts
└── infrastructure/
    ├── monitoring
    └── backup-configs

## Security Recommendations
- **Access Review**: Verify policies for each secret path
- **Rotation Schedule**: Implement regular secret rotation
- **Audit Logging**: Enable detailed audit logs for compliance
- **Least Privilege**: Ensure applications have minimal required access

**Total Secrets Found**: 7 secret paths across 3 applications
**Mount Health**: All mounts operational ✅