Integration · Security and identity
AI agents for HashiCorp Vault
Read, list, write and patch secrets in a key/value.
- Actions
- 8
- Read
- 5
- Write
- 3
Actions
What your agents can do in HashiCorp Vault
Read, list, write and patch secrets in a key/value (KV version 2) secrets engine, read a secret's version history, delete a secret's latest version, list the secrets engines a token can see, and check a server's health, on your own Vault or HCP Vault Dedicated, with a Vault token.
Read 5
Look things up. Nothing changes.
List secrets engines
Lists the secrets engines (mounts) the token can see, as data.secret.
List secrets
Lists the secret names under a folder of a KV version 2 engine (the engine's top when no path is given), as data.keys; a name ending in / is a folder to list in turn.
Read a secret
Reads a secret's key/value pairs from a KV version 2 engine, the latest version or a given one.
Read a secret's history
Reads a secret's metadata without its values: current_version, oldest_version, created_time, updated_time, max_versions, cas_required, custom_metadata, and versions.
Check Vault's health
Reads the server's health: initialized, sealed, standby, version, cluster_name and server_time_utc.
Write 3
Create, change or send.
Write a secret
Writes a new version of a secret in a KV version 2 engine, replacing all its key/value pairs with data (keys left out are gone in the new version; use "Patch a secret" to change only some).
Patch a secret
Changes only the given keys of an existing secret in a KV version 2 engine, keeping the others, as a new version (a JSON merge patch).
Delete a secret's latest versionDeletes data
Soft-deletes the latest version of a secret in a KV version 2 engine: it can no longer be read, but its metadata and older versions stay and an operator can undelete it.
A person can approve first
Any write action can be set to wait for a person's approval before it runs, so an agent asks before it changes anything. Actions that delete data ask first by default.
Connection
How it connects
Connect it once in the console, then give it to the agents and workflows that need it.
Paste an API key from your HashiCorp Vault account.
What you enter
- Vault token
Settings
- Vault address
Kept safe
- Credentials are stored encrypted with your organization's own keys.
- They are opened only by the process that makes the call, at the moment it runs, and never go into a prompt or the browser.
- Calls go only to the tool's own servers.
Ideas
Ideas to start with
Starting points made only from the actions above. Mix them with any other tool your agents can use.
- 01
Ask about your HashiCorp Vault data
Ask a question in plain words. The agent can list secrets engines, list secrets or read a secret in HashiCorp Vault, then answers with what it found.
- 02
Let an agent update HashiCorp Vault
Have the agent delete a secret's latest version in HashiCorp Vault as part of a larger task. Turn on approval and a person signs off on each change first.
- 03
Share what it finds in Slack
Give one agent HashiCorp Vault and Slack: it can list secrets engines in HashiCorp Vault and post a summary to a Slack channel in the same run.
Works well with
More Security and identity tools
- Okta14 actionsFind people and read their groups, apps, MFA factors and sign-in history in Okta, list groups and members, and run joiner and leaver steps.
- Microsoft Entra ID10 actionsFind people and groups in Microsoft Entra ID (formerly Azure Active Directory), read a person's group and role memberships and their sign-in log, add or remove group members, and run leaver and incident steps.
- Google Workspace Admin9 actionsManage people and groups in a Google Workspace domain.
- CrowdStrike Falcon8 actionsInvestigate and respond in CrowdStrike Falcon: search the hosts the Falcon sensor protects and read their details, network-contain a compromised host or lift containment, search and read alerts.
- Wiz7 actionsWork cloud security issues in Wiz: list open issues by severity or type, read one issue with the affected resource and its notes, move it to in progress, resolve or reject it with a reason, add a note.
- Vanta8 actionsTrack compliance in Vanta: see which automated tests are failing and the exact resources (users, buckets, laptops, repos) causing it, progress on each framework.
FAQ
HashiCorp Vault and MyDeepAgents
Can MyDeepAgents connect to HashiCorp Vault?
Yes. The HashiCorp Vault connector has 8 actions: 5 read and 3 make changes. Your agents can call them as tools, and your workflows can run them as steps.
How do I connect HashiCorp Vault?
Paste an API key from your HashiCorp Vault account. You'll need: Vault token. The connection also asks for: Vault address. Credentials are stored encrypted with your organization's own keys and are opened only at the moment of a call.
Can an agent change data in HashiCorp Vault without asking?
Only if you let it. Each of the 3 actions that change data can be set to wait for a person's approval before it runs, and the one that deletes data asks first by default.
Can I use HashiCorp Vault in workflows as well as agents?
Yes. Every HashiCorp Vault action also works as a step in a workflow, and the same connection serves your agents and your workflows.
Early access
Put HashiCorp Vault to work
Connect it in a few minutes, give an agent the actions it needs, and decide which changes wait for a person.