An agent runtime needs an operator-provisioned Identity identity and Vault access. These guides do not create a service account or grant an agent access automatically.

Establish the boundary

Have the operator configure the permitted workspace, credential scope and token audience. Connect the remote MCP endpoint over HTTPS. Use vault.whoami to inspect the resolved identity, tenant and available scope information. List metadata before selecting an exact key.

For each approved run, provide a stable run identifier and a useful justification when leasing. Request a lease only when the tool is ready to consume it. Redeem it once and revoke any outstanding unused lease when the work ends.

Handle returned values

The default read response returns plaintext. A structured credential is a JSON envelope, so the runtime must extract the intended field before passing it to a downstream program. Do not send the entire envelope as an API token or database password.

Reference responses require a runtime that actually implements reference substitution. Do not enable them merely because Cortex or another client supports MCP. Verify the complete consuming path using a fictional credential, including failure, expiry and logging behavior. See credential references.

Use Activity & audit to connect the run to the resulting lease and read events. The audit record establishes attribution inside Vault; it does not attest to what an external tool did afterward.

Screen reference

Open this screenshot at full size.