openbao-mcp¶

OpenBao secrets-engine API + MCP Server for the scion-sdk ecosystem — a typed, deterministic tool surface over the OpenBao (Vault-compatible) secrets, system, authentication, and SSH APIs.

Official documentation

This site is the canonical reference for openbao-mcp, maintained alongside every release.

Overview¶

openbao-mcp wraps the OpenBao HTTP API — the Linux Foundation's open-source fork of HashiCorp Vault — with typed, deterministic MCP tools an agent can call. It provides:

Api — a dynamic-facade client (openbao_mcp.api_client) over the OpenBao secrets, system, authentication, and SSH engines, configured entirely from the environment.
Action-routed MCP tools across four namespaces — secrets / key-value, system administration, authentication, and SSH — each gated by an enable flag.
An optional Pydantic-AI agent server (openbao-agent) that wraps the same tool surface for conversational orchestration.

The server remains inactive when credentials are absent and never persists secrets outside the OpenBao backend.

Explore the documentation¶

:material-rocket-start: Installation — pip, source, extras, and the prebuilt Docker image.
Deployment — run the MCP server, the agent server, Docker Compose, Caddy + Technitium.
Usage — the MCP tools, the Api client, and example prompts.
Backing Platform — deploy OpenBao with Docker.
Overview — architecture and the dynamic facade.
Concepts — the CONCEPT:BAO-* registry.

Quick start¶

pip install "openbao-mcp[mcp]"
openbao-mcp                       # stdio MCP server (default transport)

Connect it to an OpenBao server:

export OPENBAO_URL=http://127.0.0.1:8200
export OPENBAO_TOKEN=bao_root_token
openbao-mcp --transport streamable-http --host 0.0.0.0 --port 8000

See Installation and Deployment for the full matrix (PyPI extras, Docker image, all transports, the agent server, reverse proxy, DNS).

Spec delivery¶

Spec delivery dashboard. No owned specs are recorded yet. Missing requirement and code mappings remain unknown.