{ "data": { "a": { "slug": "doppler", "name": "Doppler", "vendor": "Doppler", "vendorUrl": "https://www.doppler.com", "kind": "http-api", "category": "secrets", "summary": "Hosted secrets manager organised by project, environment and config.", "url": "https://www.anchorterminal.com/tools/doppler", "markdownUrl": "https://www.anchorterminal.com/tools/doppler.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/doppler.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/doppler.json", "repo": "https://github.com/DopplerHQ/mcp-server", "license": "Apache-2.0 (MCP server and CLI), closed platform", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.doppler.com/v3", "packages": [ { "registry": "npm", "name": "@dopplerhq/mcp-server" } ], "auth": "mixed", "authNotes": "Bearer tokens on api.doppler.com. Service tokens (`dp.st.\u003cenv\u003e.…`) are scoped to one config, read-only by default and can expire with `--max-age`. Service account identities exchange an OIDC token (GitHub Actions, Kubernetes, AWS EC2 or any issuer) for a short-lived Doppler token at POST /v3/auth/oidc, Team plan and above. The MCP server takes `DOPPLER_TOKEN` or `npx @dopplerhq/mcp-server login`.", "pricing": "freemium", "pricingNotes": "Developer plan is free for 3 users then $8 a month per extra user, with 10 projects, 50 service tokens, 3-day activity logs and API-based rotation only. Team $21 a month per user with a 14-day trial, 250 projects, 500 service tokens, service accounts, automatic rotation, 90-day logs and SAML. Enterprise is custom, with dynamic secrets (AWS IAM and Azure service principals), proxied rotation, SCIM, on-prem and a 99.95% SLO. The pricing page says AI agents and non-human identities ride free, and doesn't say whether a card is needed (https://www.doppler.com/pricing, https://docs.doppler.com/docs/dynamic-secrets).", "priceSummary": "$21 / seat-mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 8, "npmWeekly": 3261, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.doppler.com", "llmsTxt": "https://docs.doppler.com/llms.txt", "openapi": "https://docs.doppler.com/openapi/core.json", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit" ], "tags": [ "hosted", "closed-source", "freemium", "free-tier", "no-card", "mcp", "openapi", "llms-txt", "typescript", "read-only-mode", "enterprise" ], "lastRelease": "2026-09-21", "graded": true, "anchor": { "graded": true, "score": 71.6, "grade": "BB", "agentReady": true, "rank": 79, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 77 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.", "strengths": [ "Service tokens bound to one config, read-only by default, with --max-age expiry", "OIDC service account identities on Team, so shared runners don't hold a static token", "OpenAPI 3.1 and an llms.txt with about 500 Markdown links", "Published per-plan rate limits with retry-after and x-ratelimit headers on a 429", "MCP server with --read-only and --config modes that cut the tool list to 36 or 10" ], "weaknesses": [ "Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts", "The MCP server is experimental, has no tool annotations or value masking, and exposes up to 89 tools by default", "35 open CLI issues, most of the newest without a reply", "The CLI keeps serving its fallback file after a token is revoked, and sends anonymous analytics unless turned off", "No SLA, only a 99.95% SLO on Enterprise" ], "agentNotes": [ "Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk", "Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail", "Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call", "On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer", "Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.6 } ], "editorialScores": { "ergonomics": 59, "maintenance": 76, "payments": 25, "reliability": 90, "schema": 81, "security": 82, "transparency": 64 }, "provenanceScore": 90 }, "connect": { "http": "curl \"https://api.doppler.com/v3/configs/config/secrets/download?format=json\" \\\n -H \"Authorization: Bearer $DOPPLER_TOKEN\"", "claudeCode": "claude mcp add doppler -e DOPPLER_TOKEN=$DOPPLER_TOKEN -- npx -y @dopplerhq/mcp-server --read-only", "config": { "mcpServers": { "doppler": { "args": [ "-y", "@dopplerhq/mcp-server", "--read-only" ], "command": "npx", "env": { "DOPPLER_TOKEN": "${DOPPLER_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/doppler" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "seat-month", "usd": 21, "note": "14-day trial" }, { "item": "Developer plan, extra user", "unit": "seat-month", "usd": 8, "note": "First 3 users free" } ], "provenance": { "legalEntity": "Doppler Technologies, Inc.", "domain": "doppler.com", "domainRegistered": "1999-01-24", "domainNote": "doppler.com was registered in 1999, long before the company, so the domain was bought later.", "endpointOnVendorDomain": true, "terms": "https://www.doppler.com/legal/terms", "privacy": "https://www.doppler.com/legal/privacy", "statusPage": "https://www.dopplerstatus.com", "changelog": "https://docs.doppler.com/changelog", "securityTxt": "unknown", "checked": "2026-10-01", "notes": [ "Terms name Doppler Technologies, Inc., 440 North Barranca Avenue #5880, Covina, CA 91723, last updated 8 February 2026. Privacy notice updated 17 September 2026, data stored in the United States.", "www.doppler.com/.well-known/security.txt is disallowed by robots.txt, so we couldn't read it.", "www.dopplerstatus.com is Atlassian Statuspage. Its history shows one incident since 3 July 2026 (CLI downloads failing, 16 July) and system outages on 18 November 2025 and 12 June 2025.", "The subprocessor list (13 July 2026) names 9 subprocessors, 8 in the United States and Groundcover in Israel, and links a DPA and an on-prem DPA.", "The security fact sheet puts all servers in GCP us-central1 and says HackerOne handles disclosures." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/doppler.json", "live": { "slug": "doppler", "probe": { "target": "https://api.doppler.com/v3", "method": "get", "lastAt": "2026-10-04T23:32:46.582114423Z", "lastOk": true, "lastStatus": 401, "lastMs": 150, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 150, "p95ms24h": 214, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://www.dopplerstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:44.403159014Z" }, "versions": [ { "registry": "github", "name": "DopplerHQ/mcp-server", "version": "v1.0.5", "released": "2026-06-04", "seenAt": "2026-10-04T16:25:42.222400654Z" }, { "registry": "npm", "name": "@dopplerhq/mcp-server", "version": "1.0.5", "seenAt": "2026-10-04T16:25:41.357710821Z" } ], "githubStars": 8, "npmWeekly": 5296, "securityTxt": { "url": "https://doppler.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:42.3339237Z" }, "llmsTxt": { "url": "https://docs.doppler.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:31.061902909Z" }, "domain": { "domain": "doppler.com", "registered": "1999-01-24", "source": "https://rdap.verisign.com/com/v1/domain/doppler.com", "checkedAt": "2026-10-04T13:08:29.130637863Z" }, "pages": [ { "url": "https://docs.doppler.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:35.303385156Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "816d6475b1bd" }, { "url": "https://www.doppler.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:50:08.235633812Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61b46ac39ff9" }, { "url": "https://www.doppler.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:50:03.99159557Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "306950b580d5" }, { "url": "https://www.doppler.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:50:06.172772616Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "642e87a74245" } ], "updatedAt": "2026-10-04T23:32:46.582114423Z" } }, "b": { "slug": "hashicorp-vault", "name": "HashiCorp Vault + Vault MCP Server", "vendor": "HashiCorp (IBM)", "vendorUrl": "https://developer.hashicorp.com/vault", "kind": "http-api", "category": "secrets", "summary": "Secrets management platform for storing credentials and controlling application access.", "url": "https://www.anchorterminal.com/tools/hashicorp-vault", "markdownUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json", "repo": "https://github.com/hashicorp/vault", "license": "BUSL-1.1 (Vault), MPL-2.0 (MCP server)", "transports": [ "http", "stdio", "streamable-http" ], "packages": [], "auth": "mixed", "authNotes": "Every request carries a Vault token in `X-Vault-Token` (or as an HTTP bearer token). Machines get a token from an auth method such as AppRole, Kubernetes, JWT/OIDC, AWS, GCP, Azure, TLS certificates and more. Enterprise 2.0.3+ lets a registered agent present an OAuth 2.0 JWT from your identity provider directly, with RAR claims (RFC 9396) narrowing paths. The MCP server reads VAULT_ADDR, VAULT_TOKEN and VAULT_NAMESPACE, or takes them as headers in HTTP mode.", "pricing": "freemium", "pricingNotes": "Vault Community is free to run under the BUSL-1.1, which forbids selling a competing hosted product. HCP Vault Dedicated is hourly per cluster on the IBM price list. Development extra small $0.61644 an hour, Essentials small $1.57799, medium $3.16299, large $7.48857, Standard small $1.84299, medium $3.69099, large $9.40599, plus $72.92 a month per product client. Prices are indicative and exclude tax. Vault Enterprise self-managed is quoted, and the 2.1.0 licence added Agentic IAM terms. HCP has a $500 pay-as-you-go credit (https://www.ibm.com/products/hashicorp/pricing, https://www.hashicorp.com/en/pricing).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": 16, "popularity": { "githubStars": 36234, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developer.hashicorp.com/vault/docs", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host", "auth.agent-identity" ], "tags": [ "hosted", "self-hosted", "source-available", "freemium", "mcp", "local", "go", "enterprise", "eu" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 64.4, "grade": "B", "agentReady": false, "rank": 184, "ranked": true, "rankOf": 452, "categoryRank": 7, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 77, "payments": 30, "reliability": 71, "schema": 74, "security": 86, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -5, "negativeNotes": [ "-4: The official Vault MCP server fixed cross-user credential inheritance through a shared MCP session ID on 2026-07-28 and an SSRF through a VAULT_ADDR query parameter on 2026-08-11, but the newest binary and Docker image are still 0.2.0 from 2025-09-24 and no advisory was published (https://github.com/hashicorp/vault-mcp-server/commits/main, https://releases.hashicorp.com/vault-mcp-server/)", "-1: Vault 2.0.3 (2026-06-17) fixed a LIST ACL bypass where a trailing slash skipped a more specific deny rule; fixed and documented in the changelog, so it decays (https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)" ], "verdict": "Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.", "strengths": [ "Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after", "Path policies with explicit deny, audit devices on every edition, and Agent Registry with ceiling policies on Enterprise", "Auth methods for every major cloud, Kubernetes, JWT/OIDC and AppRole", "Three releases between 4 August and 16 September 2026 with a dated changelog that names each CVE fixed", "Each server generates its own OpenAPI document at /v1/sys/internal/specs/openapi" ], "weaknesses": [ "The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased", "Agentic IAM, control groups and the OAuth resource server are Enterprise only", "BUSL-1.1, not an OSI licence, and HCP Vault Secrets was retired within two years of launch", "No llms.txt, and the only official client library is Go", "HCP client pricing ($72.92 a client a month) can dwarf the cluster price for many agents, and no SLA is published" ], "agentNotes": [ "Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call", "Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request", "For KV v2, GET /v1/\u003cmount\u003e/data/\u003cpath\u003e and read data.data, and pass cas on writes so a retry can't overwrite a newer version", "If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount", "Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.4 } ], "editorialScores": { "ergonomics": 64, "maintenance": 77, "payments": 30, "reliability": 71, "schema": 74, "security": 86, "transparency": 65 }, "provenanceScore": 100 }, "connect": { "install": "docker run --rm -p 8200:8200 hashicorp/vault server -dev # or download vault-mcp-server from releases.hashicorp.com", "http": "curl -H \"X-Vault-Token: $VAULT_TOKEN\" \"$VAULT_ADDR/v1/secret/data/myapp\"", "claudeCode": "claude mcp add vault -e VAULT_ADDR=$VAULT_ADDR -e VAULT_TOKEN=$VAULT_TOKEN -- vault-mcp-server stdio", "config": { "mcpServers": { "vault": { "args": [ "run", "-i", "--rm", "-e", "VAULT_ADDR", "-e", "VAULT_TOKEN", "hashicorp/vault-mcp-server" ], "command": "docker", "env": { "VAULT_ADDR": "${VAULT_ADDR}", "VAULT_TOKEN": "${VAULT_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/hashicorp-vault" }, "sameCompany": [ "terraform-mcp" ], "area": "agent-runtime", "unitPrices": [ { "item": "HCP Vault Dedicated, product client", "unit": "account-month", "usd": 72.92, "note": "Per client a month, Essentials and Standard" } ], "provenance": { "legalEntity": "HashiCorp, Inc. (an IBM company)", "domain": "hashicorp.com", "domainRegistered": "2011-04-30", "endpointOnVendorDomain": true, "terms": "https://www.hashicorp.com/en/terms-of-service", "privacy": "https://www.hashicorp.com/en/privacy", "statusPage": "https://status.hashicorp.com", "changelog": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The website terms name HashiCorp, Inc. and were last updated March 2018. The privacy policy (20 April 2026) gives HashiCorp, an IBM Company, c/o 1 North Castle Drive, Armonk, New York, and notes the IBM acquisition closed on 27 February 2025.", "security.txt has Contact, Policy and Encryption but no Expires field.", "HCP prices come from the IBM price table and are marked indicative, varying by country.", "status.hashicorp.com runs on incident.io. From 1 July to 1 October 2026 it posted nothing against HCP Vault Dedicated; it did post a DR cluster creation failure on HCP (6 August) and a releases.hashicorp.com outage (26 September).", "The Vault MCP server's newest published build is 0.2.0 (24 September 2025) on releases.hashicorp.com and Docker Hub, although its VERSION file and changelog say 0.2.1." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.json", "live": { "slug": "hashicorp-vault", "vendorStatus": { "page": "https://status.hashicorp.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:50.15354632Z" }, "versions": [ { "registry": "github", "name": "hashicorp/vault", "version": "v2.1.1", "released": "2026-09-16", "seenAt": "2026-10-04T16:29:29.320950791Z" } ], "githubStars": 36339, "securityTxt": { "url": "https://hashicorp.com/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-10-04T15:16:00.556489725Z" }, "domain": { "domain": "hashicorp.com", "registered": "2011-04-30", "source": "https://rdap.verisign.com/com/v1/domain/hashicorp.com", "checkedAt": "2026-10-04T13:10:23.718306751Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/hashicorp/vault/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-04T15:47:41.235618427Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0620845f2f7e" }, { "url": "https://www.ibm.com/support/pages/hcp-vault-secrets-end-life", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-04T15:50:50.575718841Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e24e2e2b51c3" }, { "url": "https://www.hashicorp.com/en/pricing", "kind": "pricing", "status": 429, "checkedAt": "2026-10-04T15:50:36.37620806Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.ibm.com/products/hashicorp/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:50:46.127664694Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0e262eb503c4" }, { "url": "https://www.hashicorp.com/en/privacy", "kind": "privacy", "status": 429, "checkedAt": "2026-10-04T15:50:38.389849123Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.hashicorp.com/en/terms-of-service", "kind": "terms", "status": 429, "checkedAt": "2026-10-04T15:50:40.386204192Z", "changedAt": "0001-01-01T00:00:00Z" } ], "updatedAt": "2026-10-04T23:27:50.15354632Z" } }, "summary": "Doppler has a score of 71.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is reliability, 19 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault", "json": "https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md", "slim": "https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.min.md" }, "markdown": "Doppler has a score of 71.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is reliability, 19 points.\n\n- Doppler: grade BB, 71.6/100, rank #79 of 452. Markdown https://www.anchorterminal.com/tools/doppler.md · JSON https://www.anchorterminal.com/api/v1/tools/doppler.json\n- HashiCorp Vault + Vault MCP Server: grade B, 64.4/100, rank #184 of 452. Markdown https://www.anchorterminal.com/tools/hashicorp-vault.md · JSON https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json\n\n## Which one, for what\n\nPick Doppler for reliability (+19), schema \u0026 documentation (+7).\n\nPick HashiCorp Vault + Vault MCP Server for agent ergonomics (+5), payments \u0026 pricing (+5), transparency \u0026 trust (+6).\n\n## Score by category\n\n| Category | Weight | Doppler | HashiCorp Vault + Vault MCP Server | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 90 | 71 | Doppler +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 81 | 74 | Doppler +7 |\n| Agent ergonomics | 13% (16.2 this run) | 59 | 64 | HashiCorp Vault + Vault MCP Server +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 82 | 86 | HashiCorp Vault + Vault MCP Server +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 30 | HashiCorp Vault + Vault MCP Server +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 76 | 77 | HashiCorp Vault + Vault MCP Server +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 77 | 83 | HashiCorp Vault + Vault MCP Server +6 |\n| Negative events | ≤15 | 0 | -5 | |\n| **Total** | | **71.6 · BB** | **64.4 · B** | |\n\n## Facts side by side\n\n| Fact | Doppler | HashiCorp Vault + Vault MCP Server |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Doppler | HashiCorp (IBM) |\n| Hosted endpoint | `https://api.doppler.com/v3` | no (local only) |\n| Transports | HTTP, stdio | HTTP, stdio, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 (MCP server and CLI), closed platform | BUSL-1.1 (Vault), MPL-2.0 (MCP server) |\n| Tools exposed | none | 16 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | no |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-21 | 2026-09-16 |\n| Popularity | 8 stars, 3.3k npm/wk | 36k stars |\n| Agent reviews | 3/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**Doppler.** Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.\n\n**HashiCorp Vault + Vault MCP Server.** Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.\n\n## Before you call either\n\n### Doppler\n\n1. Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- \u003ccmd\u003e` so values never touch disk\n2. Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail\n3. Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call\n4. On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer\n5. Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported\n\n### HashiCorp Vault + Vault MCP Server\n\n1. Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call\n2. Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request\n3. For KV v2, GET /v1/\u003cmount\u003e/data/\u003cpath\u003e and read data.data, and pass cas on writes so a retry can't overwrite a newer version\n4. If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount\n5. Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After\n\n## Other comparisons with Doppler or HashiCorp Vault + Vault MCP Server\n\n- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)\n- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)\n- [Akeyless (SecretlessAI and MCP server) vs Doppler](https://www.anchorterminal.com/compare/akeyless-vs-doppler.md)\n- [Akeyless (SecretlessAI and MCP server) vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/akeyless-vs-hashicorp-vault.md)\n- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)\n- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)\n- [Bitwarden Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-doppler.md)\n- [Bitwarden Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-hashicorp-vault.md)\n- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)\n- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)\n- [Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md)\n- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Doppler vs HashiCorp Vault + Vault MCP Server", "url": "" } ], "description": "Doppler has a score of 71.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is reliability, 19 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Doppler BB 71.6", "HashiCorp Vault + Vault MCP Server B 64.4", "scores" ], "h1": "Doppler vs HashiCorp Vault + Vault MCP Server", "image": "https://www.anchorterminal.com/assets/og/compare-doppler-vs-hashicorp-vault.png", "path": "/compare/doppler-vs-hashicorp-vault", "published": "2026-10-01", "section": "tools", "title": "Doppler vs HashiCorp Vault + Vault MCP Server for AI agents", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault" }, "tokens": { "markdown": 1700, "slim": 330 }, "version": 1 }