Build a HashiCorp Vault Secrets Manager MCP Server with Ephemeral Token Rotation for AI Agents in 2026

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

The Security Crisis of Hardcoded Agent Credentials in 2026

Autonomous AI agents in 2026 routinely interact with cloud infrastructure, payment gateways, production relational databases, and enterprise internal microservices. When agents are provisioned with static, long-lived API keys or persistent environment secrets, any prompt injection exploit or compromised execution loop exposes the entire infrastructure to credential harvesting and data exfiltration.

The solution is ephemeral, just-in-time credential vending. By integrating HashiCorp Vault with the Model Context Protocol (MCP), agents request scoped, time-bounded access tokens that automatically expire and self-revoke upon task completion. Rather than storing static AWS keys, PostgreSQL master passwords, or Stripe secret tokens in local configuration files, autonomous agents call native MCP tools to acquire temporary credentials with strict time-to-live (TTL) limits.

For security engineers hardening systems across our production AI workflows and discovering modular connectors in the MCP directory, this dispatch delivers a TypeScript FastMCP server delivering dynamic secrets generation, automatic lease management, and cryptographic audit logging.

┌─────────────────────────────────────────────────────────────┐
│          Claude Desktop / Cursor IDE / Agent Pipeline       │
└──────────────────────────────┬──────────────────────────────┘
                               │ MCP Request (Scope + TTL)
                               ▼
┌─────────────────────────────────────────────────────────────┐
│       HashiCorp Vault Secrets Manager FastMCP Server        │
│  ├─ get_ephemeral_secret (Dynamic read with automatic lease)│
│  ├─ generate_database_creds (Dynamic SQL user creation)     │
│  └─ revoke_secret_lease (Explicit lease teardown)           │
└──────────────────────────────┬──────────────────────────────┘
                               │ Mutual TLS AppRole Auth
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                HashiCorp Vault Enterprise                   │
│  ├─ KV v2 Engine (/secret/data/agents/*)                    │
│  ├─ Dynamic Database Secrets Engine (Postgres/MySQL)        │
│  └─ Ephemeral Token Lease Coordinator (Auto-Revoke Daemon)  │
└─────────────────────────────────────────────────────────────┘

Vault Policy & AppRole Security Hardening

Before running the server, configure HashiCorp Vault with an AppRole and bounded lease policies that restrict agent credential lifespans to a maximum of 15 minutes. This architecture enforces strict zero-trust credential isolation:

# agent-policy.hcl: Least-Privilege Agent Secret Policy
path "secret/data/agents/*" {
  capabilities = ["read"]
}

path "database/creds/agent-ephemeral-role" {
  capabilities = ["read"]
}

path "sys/leases/revoke" {
  capabilities = ["update"]
}

path "sys/leases/lookup" {
  capabilities = ["read"]
}

Apply the policy and create the authentication binding via Vault CLI commands:

# Provision Policy and AppRole Binding
vault policy write agent-ephemeral-policy agent-policy.hcl

vault write auth/approle/role/mcp-agent-role     secret_id_ttl=60m     token_ttl=15m     token_max_ttl=30m     token_num_uses=50     policies="agent-ephemeral-policy"

vault read auth/approle/role/mcp-agent-role/role-id
vault write -f auth/approle/role/mcp-agent-role/secret-id

Production FastMCP TypeScript Server Implementation

Below is the complete FastMCP server implementation written in modern TypeScript, providing dynamic secret retrieval, JIT database credentials, and explicit lease revocation:

// server.ts: HashiCorp Vault FastMCP Server
// Dependencies: @modelcontextprotocol/sdk node-vault zod dotenv
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";
import vaultFactory from "node-vault";
import dotenv from "dotenv";

dotenv.config();

const VAULT_ADDR = process.env.VAULT_ADDR || "http://127.0.0.1:8200";
const VAULT_ROLE_ID = process.env.VAULT_ROLE_ID || "";
const VAULT_SECRET_ID = process.env.VAULT_SECRET_ID || "";

const vault = vaultFactory({
  apiVersion: "v1",
  endpoint: VAULT_ADDR,
});

async function authenticateAppRole(): Promise<string> {
  if (!VAULT_ROLE_ID || !VAULT_SECRET_ID) {
    throw new Error("Missing VAULT_ROLE_ID or VAULT_SECRET_ID credentials in environment.");
  }
  const result = await vault.approleLogin({
    role_id: VAULT_ROLE_ID,
    secret_id: VAULT_SECRET_ID,
  });
  vault.token = result.auth.client_token;
  return result.auth.client_token;
}

const server = new McpServer({
  name: "hashicorp-vault-secrets",
  version: "1.0.0",
});

server.tool(
  "get_ephemeral_secret",
  "Fetch an ephemeral secret from Vault KV v2 engine with lease metadata",
  {
    secret_path: z.string().describe("Path to secret e.g., agents/stripe_key"),
  },
  async ({ secret_path }) => {
    try {
      await authenticateAppRole();
      const readResult = await vault.read(`secret/data/${secret_path}`);
      const secretData = readResult.data?.data || {};
      
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify({
              status: "success",
              path: secret_path,
              data: secretData,
              lease_id: readResult.lease_id || "kv-static-lease",
              lease_duration_seconds: readResult.lease_duration || 900,
              renewable: readResult.renewable || false,
            }, null, 2),
          },
        ],
      };
    } catch (error: any) {
      return {
        content: [{ type: "text", text: JSON.stringify({ status: "error", message: error.message }) }],
        isError: true,
      };
    }
  }
);

server.tool(
  "generate_database_creds",
  "Generate just-in-time ephemeral database credentials with auto-revocation",
  {
    role_name: z.string().default("agent-ephemeral-role").describe("Vault dynamic DB role"),
  },
  async ({ role_name }) => {
    try {
      await authenticateAppRole();
      const creds = await vault.read(`database/creds/${role_name}`);
      
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify({
              status: "success",
              username: creds.data.username,
              password: creds.data.password,
              lease_id: creds.lease_id,
              lease_duration_seconds: creds.lease_duration,
              expires_at: new Date(Date.now() + creds.lease_duration * 1000).toISOString(),
            }, null, 2),
          },
        ],
      };
    } catch (error: any) {
      return {
        content: [{ type: "text", text: JSON.stringify({ status: "error", message: error.message }) }],
        isError: true,
      };
    }
  }
);

server.tool(
  "revoke_secret_lease",
  "Explicitly revoke an ephemeral secret lease immediately upon task completion",
  {
    lease_id: z.string().describe("Lease ID returned during credential generation"),
  },
  async ({ lease_id }) => {
    try {
      await authenticateAppRole();
      await vault.revoke({ lease_id });
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify({
              status: "success",
              message: `Lease ${lease_id} successfully revoked. Credentials invalidated.`,
            }),
          },
        ],
      };
    } catch (error: any) {
      return {
        content: [{ type: "text", text: JSON.stringify({ status: "error", message: error.message }) }],
        isError: true,
      };
    }
  }
);

async function main() {
  const transport = new StdioServerTransport();
  await server.connect(transport);
}

main().catch(console.error);

Configuration & Client Setup

Add the HashiCorp Vault Secrets Manager MCP server to .cursor/mcp.json or claude_desktop_config.json:

{
  "mcpServers": {
    "vault-secrets": {
      "command": "node",
      "args": ["dist/server.js"],
      "cwd": "/opt/mcp-servers/vault-secrets",
      "env": {
        "VAULT_ADDR": "https://vault.internal.infra:8200",
        "VAULT_ROLE_ID": "6f2a89c1-4b72-4e99-8d14-3a7e58a20491",
        "VAULT_SECRET_ID": "e4c7b891-2a6d-49f3-8b77-5e9a4f21087b"
      }
    }
  }
}

Production Security Audit & Performance Impact

Implementing just-in-time ephemeral secrets via MCP neutralizes credential leak vectors across distributed agent runtimes. When building complex autonomous workflows such as edge database instances in the Cloudflare D1 SQLite MCP Server or executing cross-cluster vector migrations in the Vector DB Migration MCP Server, scoped credentials safeguard downstream resources from unauthorized persistence.

Autonomous agents operating with ephemeral credentials ensure that rogue prompts cannot retain long-term persistence in production databases or external vendor APIs. Even in cases where an adversary captures a session token through indirect injection, the automatic 15-minute lease expiration guarantees that the compromised secret is revoked before unauthorized extraction can take place.

To maintain comprehensive defensive postures against runtime prompt injection and permission escalation, review our breakdown of The 2026 Prompt Injection Taxonomy and track cutting-edge enterprise AI updates at Daily AI World Latest News.

Last tested: August 2026 with Python 3.12, Node v22, and latest framework releases.