Example prompt: Delete and cleanup secrets

Beta feature

Beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production deployments of Vault.

Use the following example as a guide to help you write your own prompt to perform secure cleanup operations on kv secrets.

Assumptions

You have a running HashiCorp Vault instance.
You have the Vault MCP server running.
You have a valid Vault authentication token with appropriate permissions for the resource you want to modify.
You have a local MCP client configured (e.g., Claude for Desktop, VS Code).
You have the kv plugin enabled.

Prompt

I need to clean up old secrets. Delete the database 
credentials from secret/legacy/old-app and remove 
the entire legacy mount if it's empty.

Expected workflow

The MCP server performs the following operations:

Delete specific secret: Removes the targeted secret path
List remaining secrets: Checks if mount is empty
Conditional cleanup: Removes mount if no secrets remain

Associated API request objects

Request object to delete the old-app credentials:

{
  "mount": "secret",
  "path": "legacy/old-app"
}

Request object to list any remaining secrets:

{
  "mount": "secret", 
  "path": "legacy/"
}

Sample response

Disclaimer

Example responses come from using the Vault MCP server with ChatGPT 4.1 in GitHub Copilot on VS Code. Your responses may vary.

Cleanup operations completed successfully:

## Deleted Resources
- ✅ **Secret Removed**: `secret/legacy/old-app`
  - All versions and metadata permanently deleted
  - Secret contained 3 keys (username, password, connection_string)

## Mount Analysis  
- **Path**: `secret/legacy/`
- **Status**: Empty (no remaining secrets)
- **Recommendation**: Mount can be safely removed if no longer needed

## Security Notes
- **Audit Trail**: Deletion logged in Vault audit logs
- **Recovery**: No recovery possible - ensure backups if needed
- **Access Policies**: Review and clean up associated Vault policies

Would you like me to remove the empty legacy path structure 
or keep it for future use?