Reported issues for Vault MCP
Pod holds 7 of 7 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to Vault MCP.
Most discussed
Plugin system for custom auth patterns
Why: Some APIs use exotic auth mechanisms (AWS Sig v4, Digest auth, HMAC, custom signing). Instead of building each one into core, provide a plugin interface.
Scope:
- Plugin interface: receive credential data, return modified request (headers, URL, body)
- Load plugins from ~/.vault-mcp/plugins/
- Built-in plugins for common patterns
Use cases:
- AWS Sig v4 as a plugin
- MongoDB Atlas Digest auth
- Custom HMAC-signing APIs
Priority: Medium — enables community contributions
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
Digest auth support
Why: Some APIs (MongoDB Atlas Admin API, older HTTP servers) use HTTP Digest authentication instead of Basic or Bearer.
Scope:
- Add auth_type: 'digest' to vault_api_request
- Implement challenge-response Digest auth (RFC 7616)
- Store username + password for Digest
Priority: Low — niche use case
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
OAuth2 flow support (Authorization Code + PKCE + token refresh)
Why: Many APIs (Google Sheets, Meta Ads, Spotify, etc.) require OAuth2 tokens that expire. Currently Vault can only store static tokens — when they expire, the user must manually re-authenticate.
Scope:
- Authorization Code flow with PKCE
- Token refresh (store refresh_token, auto-get new access_token)
- Support for Google, Meta, Slack, Shopify OAuth2 providers
Use cases:
- Google Sheets API with user OAuth tokens
- Meta Ads API with long-lived tokens that need periodic refresh
- S
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
Browser session reuse between vault_login calls
Why: Currently each vault_login opens a new Chrome tab. If the user is already logged in (from a previous vault_login), we waste time re-authenticating.
Scope:
- Check if already logged in (cookie/session check) before filling login form
- Reuse existing Chrome context/tab
- Integrate with vault_check for pre-login validation
Priority: Low — optimization, not blocking
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
Environment variable injection for child processes
Why: Database clients (PostgreSQL, MySQL, Redis) and cloud SDKs (GCP, AWS) expect credentials as environment variables (DATABASE_URL, GOOGLE_APPLICATION_CREDENTIALS, AWS_SECRET_ACCESS_KEY). Vault currently only handles HTTP-level auth.
Scope:
- New tool: vault_exec — run a command with secrets injected as env vars
- Secrets never appear in the agent's context
- Audit logging for each exec call
Use cases:
- PostgreSQL: vault_exec("psql", { DB_PASSWORD: "mydb" })
- GCP SDK: vault_exe
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
AWS Signature v4 support
Why: AWS APIs use HMAC-based per-request signing (Sig v4), not static Bearer tokens. Each request must be signed with the secret key, region, service name, and timestamp.
Scope:
- Built-in AWS Sig v4 signer
- Store AWS Access Key ID + Secret Access Key
- Auto-sign requests to any AWS service
Use cases:
- S3, DynamoDB, SES, Lambda, EC2 API calls
- Amazon Seller Central SP-API (also needs OAuth2 + Sig v4)
Priority: Medium — AWS is ubiquitous but the signing is complex
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
Token rotation and auto-refresh
Why: OAuth tokens and some API keys expire. Vault should detect expiration and auto-refresh.
Scope:
- Store refresh_token alongside access_token
- Auto-refresh when access_token is expired (before making API call)
- Support configurable token endpoints
- Log token refreshes in audit trail
Depends on: OAuth2 flow support
Priority: Medium
Read the thread · 2026-03-01 · open · outside contributor · 0 comments
Most recent
The remaining reports are on the project's issue tracker.