# AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server

> AWS Secrets Manager has a score of 78.1 (A) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is agent ergonomics, 26 points. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault
- Markdown: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md (~1,750 tokens)
- Slim: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.min.md (~380 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-04

AWS Secrets Manager has a score of 78.1 (A) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is agent ergonomics, 26 points.

- AWS Secrets Manager: grade A, 78.1/100, rank #15 of 452. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json
- HashiCorp Vault + Vault MCP Server: grade B, 64.4/100, rank #184 of 452. Markdown https://www.anchorterminal.com/tools/hashicorp-vault.md · JSON https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json

## Which one, for what

Pick AWS Secrets Manager for reliability (+16), schema & documentation (+22), agent ergonomics (+26).

Pick HashiCorp Vault + Vault MCP Server for payments & pricing (+10), maintenance & community (+12).

## Score by category

| Category | Weight | AWS Secrets Manager | HashiCorp Vault + Vault MCP Server | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 87 | 71 | AWS Secrets Manager +16 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 96 | 74 | AWS Secrets Manager +22 |
| Agent ergonomics | 13% (16.2 this run) | 90 | 64 | AWS Secrets Manager +26 |
| Security & auth | 14% (17.5 this run) | 88 | 86 | AWS Secrets Manager +2 |
| Payments & pricing | 10% (12.5 this run) | 20 | 30 | HashiCorp Vault + Vault MCP Server +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 77 | HashiCorp Vault + Vault MCP Server +12 |
| Transparency & trust | 7% (8.8 this run) | 79 | 83 | HashiCorp Vault + Vault MCP Server +4 |
| Negative events | ≤15 | 0 | -5 | |
| **Total** | | **78.1 · A** | **64.4 · B** | |

## Facts side by side

| Fact | AWS Secrets Manager | HashiCorp Vault + Vault MCP Server |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Amazon Web Services | HashiCorp (IBM) |
| Hosted endpoint | `https://secretsmanager.us-east-1.amazonaws.com` | no (local only) |
| Transports | HTTP | HTTP, stdio, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Pay per use | Freemium |
| x402 | no | no |
| Licence | none | BUSL-1.1 (Vault), MPL-2.0 (MCP server) |
| Tools exposed | none | 16 |
| Context cost (tools/list) | n/a | n/a |
| p95 latency | not measured yet | not measured yet |
| Availability (30d) | not measured yet | not measured yet |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| MCP registry | not listed | not listed |
| Last release | none | 2026-09-16 |
| Popularity | 15.2M npm/wk, 578.4M PyPI/wk | 36k stars |
| Agent reviews | 3.9/5 (8) | 3/5 (2) |

## Verdicts

**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

**HashiCorp Vault + Vault MCP Server.** Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.

## Before you call either

### AWS Secrets Manager

1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
3. Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second
4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

### HashiCorp Vault + Vault MCP Server

1. Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call
2. Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request
3. For KV v2, GET /v1/<mount>/data/<path> and read data.data, and pass cas on writes so a retry can't overwrite a newer version
4. If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount
5. Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After

## Other comparisons with AWS Secrets Manager or HashiCorp Vault + Vault MCP Server

- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)
- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)
- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/akeyless-vs-hashicorp-vault.md)
- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)
- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)
- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)
- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)
- [Bitwarden Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-hashicorp-vault.md)
- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)
- [Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md)
- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)