Prompt an AI model
Use your AI agent to manage Vault resources using the Vault MCP server.
Prompt AI to use the MCP server tools
To use the MCP server tools, feed your LLM prompts that pertain to specific Vault operations like managing secrets, configuring PKI, or administering mounts. The LLM should use the Vault MCP server to perform these operations directly against your Vault instance.
Your model may still decide to use other resources to formulate responses, but you can use the following guidelines to help you create prompts that are more likely to be routed through the server:
- Include specific Vault terminology like "secret engine", "mount path", "PKI role", or "certificate issuance".
- Specify exact paths and mount names when working with secrets (e.g.,
/secret/myapp/config). - Use clear action words like "create", "read", "write", "delete", "list", or "issue".
- Mention specific secret engine types like "KV v2", "PKI", or "key-value store".
- Reference Vault-specific concepts like TTL, certificate authorities, or namespace.
Best practices for Vault MCP prompts
- Use effective prompt structure:
- Be Specific: Use exact mount paths and secret names
- Include Context: Mention the purpose (app credentials, certificates, etc.)
- Specify Requirements: TTL values, certificate parameters, security policies
- Request Validation: Ask for confirmation of operations before execution
- Follow good security hygiene:
- Principle of Least Privilege: Request minimal necessary permissions
- Audit Trail: Ensure operations are logged and traceable
- Secret Lifecycle: Consider rotation, expiration, and cleanup
- Access Patterns: Design secrets structure for application access patterns
- Work with common use cases:
- Manage application secrets: Database credentials, API keys, service tokens
- Mange PKI certificates: Certificate authorities, SSL certificates, key rotation
- Automate infrastructure: Terraform secrets, CI/CD credentials
- Review compliance: Audit trails, access reviews, secret inventory