You need Vault access and a Claude Code installation that supports remote HTTP MCP with browser OAuth. Do not paste a token into the server URL.

Add and authorize the server

claude mcp add --transport http vault https://vault.ghoststack.app/api/mcp --callback-port 8123

Open Claude Code, run /mcp, select Vault and complete sign-in through Identity. Check the account and workspace before approving the connection. When the browser says Return to your client, return and check the client’s connection status; the browser message alone does not prove the client finished connecting.

Check a safe first request

Ask the client to call vault.whoami and list permitted credential metadata. Confirm the workspace and expected key before requesting a value. A normal use flow is vault.list_credentials or vault.search_credentials, then vault.lease_credential, then vault.read_credential.

The read response contains plaintext by default, often as a typed JSON envelope. Ordinary MCP support does not guarantee secret substitution outside model context. Use only an approved handling path, and do not ask the client to print secret values in its reply.

If authorization fails, check the client’s callback configuration, your Identity connection and the scopes described in the reference. Reconnect through the client’s MCP controls after an expired or revoked authorization.

Screen reference

Open this screenshot at full size.