openbao-mcp¶

OpenBao secrets-engine API + MCP Server for the agent-utilities ecosystem — a typed, deterministic tool surface over the OpenBao (Vault-compatible) secrets, system, authentication, and SSH APIs.

Official documentation

This site is the canonical reference for openbao-mcp, maintained alongside every release.

Overview¶

openbao-mcp wraps the OpenBao HTTP API — the Linux Foundation's open-source fork of HashiCorp Vault — with typed, deterministic MCP tools an agent can call. It provides:

Api — a dynamic-facade client (openbao_mcp.api_client) over the OpenBao secrets, system, authentication, and SSH engines, configured entirely from the environment.
Action-routed MCP tools across four namespaces — secrets / key-value, system administration, authentication, and SSH — each gated by an enable flag.
An optional Pydantic-AI agent server (openbao-agent) that wraps the same tool surface for conversational orchestration.

The server remains inactive when credentials are absent and never persists secrets outside the OpenBao backend.

Explore the documentation¶

Installation — pip, source, extras, and the prebuilt Docker image.
Deployment — run the MCP server, the agent server, Docker Compose, Caddy + Technitium.
Usage — the MCP tools, the Api client, and example prompts.
Backing Platform — deploy OpenBao with Docker.
Overview — architecture and the dynamic facade.
Concepts — the CONCEPT:BAO-* registry.

Quick start¶

pip install "openbao-mcp[mcp]"
openbao-mcp                       # stdio MCP server (default transport)

Connect it to an OpenBao server:

export OPENBAO_URL=http://127.0.0.1:8200
export OPENBAO_TOKEN=bao_root_token
openbao-mcp --transport streamable-http --host 0.0.0.0 --port 8000

See Installation and Deployment for the full matrix (PyPI extras, Docker image, all transports, the agent server, reverse proxy, DNS).