{ "data": { "a": { "slug": "google-secret-manager", "name": "Google Cloud Secret Manager", "vendor": "Google Cloud", "vendorUrl": "https://cloud.google.com/security/products/secret-manager", "kind": "http-api", "category": "secrets", "summary": "Google Cloud's managed service for storing and accessing application secrets.", "url": "https://www.anchorterminal.com/tools/google-secret-manager", "markdownUrl": "https://www.anchorterminal.com/tools/google-secret-manager.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/google-secret-manager.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/google-secret-manager.json", "repo": "https://github.com/googleapis/google-cloud-python", "license": "Apache-2.0 (client libraries)", "transports": [ "http" ], "remoteUrl": "https://secretmanager.googleapis.com/v1", "packages": [ { "registry": "npm", "name": "@google-cloud/secret-manager" }, { "registry": "pypi", "name": "google-cloud-secret-manager" } ], "auth": "oauth", "authNotes": "OAuth 2.0 bearer tokens from a Google service account or workload identity (GKE, Cloud Run, GCE metadata server) with the cloud-platform scope. Grant roles/secretmanager.secretAccessor on the secret, not the project, and add IAM conditions for time or version limits. API keys don't work here.", "pricing": "usage", "pricingNotes": "$0.06 per active secret version per location a month (billed hourly at $0.000082192), $0.03 per 10,000 access operations and $0.05 per rotation notification. Management operations are free. Always free each month for 6 active versions, 10,000 access operations and 3 rotation notifications, and new customers get $300 of trial credit. A user-managed replication policy is charged per location; automatic replication counts as one (https://cloud.google.com/secret-manager/pricing).", "priceSummary": "$0.06 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 4224871, "pypiWeekly": 13586494, "asOf": "2026-09-30" }, "docsUrl": "https://docs.cloud.google.com/secret-manager/docs", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "infra.cloud" ], "tags": [ "hosted", "closed-source", "usage-priced", "free-tier", "card-required", "typescript", "python", "go", "enterprise", "eu" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 76.6, "grade": "BB", "agentReady": true, "rank": 26, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 87, "payments": 20, "reliability": 87, "schema": 83, "security": 85, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.", "strengths": [ "Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused", "$0.06 a version a month and $0.03 per 10,000 accesses, with 6 versions and 10,000 accesses a month free", "IAM conditions and per-secret roles, with version_destroy_ttl to delay destruction", "Regional secrets for data residency and multi-region storage in US, EU, Canada and India", "99.95% SLA with credits, and five dated release notes between 12 July and 14 September 2026" ], "weaknesses": [ "Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle", "Secret reads are Data Access audit logs, which you have to enable", "Global secrets accept only 2 version writes a second, and AddSecretVersion has no request ID for safe retries", "No llms.txt and no Secret Manager MCP server", "Off Google Cloud you need a service account key or workload identity federation, and a billing account with a card" ], "agentNotes": [ "Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version", "Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent", "Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read", "Read once per run and cache; accesses past 10,000 a month are metered", "Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.6, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.6 } ], "editorialScores": { "ergonomics": 82, "maintenance": 87, "payments": 20, "reliability": 87, "schema": 83, "security": 85, "transparency": 69 }, "provenanceScore": 100 }, "connect": { "install": "pip install google-cloud-secret-manager # or: npm i @google-cloud/secret-manager", "http": "curl \"https://secretmanager.googleapis.com/v1/projects/$GOOGLE_CLOUD_PROJECT/secrets/db-password/versions/latest:access\" \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\"" }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/google-secret-manager" }, "sameCompany": [ "gemini-api", "gemini-embedding", "vertex-ai-tuning", "google-model-armor", "google-imagen", "google-veo", "google-lyria", "google-speech-to-text", "google-adk", "google-weather-api", "chrome-devtools-mcp", "google-maps-platform", "google-cloud-translation", "google-calendar-api", "google-drive-api", "gemini-cli" ], "area": "agent-runtime", "unitPrices": [ { "item": "Active secret version", "unit": "month", "usd": 0.06, "note": "Per version per location a month" }, { "item": "Access operations", "unit": "1k-calls", "usd": 0.003, "note": "$0.03 per 10,000 operations" }, { "item": "Rotation notification", "unit": "message", "usd": 0.05, "note": "Per SECRET_ROTATE message to Pub/Sub" } ], "provenance": { "legalEntity": "Google LLC (Google Cloud EMEA Limited and other regional entities by billing address)", "domain": "google.com", "domainRegistered": "1997-09-15", "domainNote": "The API lives at secretmanager.googleapis.com and the docs at docs.cloud.google.com, both Google domains.", "endpointOnVendorDomain": true, "terms": "https://cloud.google.com/terms", "privacy": "https://policies.google.com/privacy", "statusPage": "https://status.cloud.google.com", "changelog": "https://docs.cloud.google.com/secret-manager/docs/release-notes", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The Google Cloud Platform Terms of Service point to cloud.google.com/terms/google-entity, which names Google LLC for the United States and fourteen regional entities including Google Cloud EMEA Limited.", "www.google.com/.well-known/security.txt expires 2030-04-01 (30 September check).", "status.cloud.google.com/incidents.json had no incident tagged Secret Manager between 1 July and 1 October 2026.", "The pricing page loaded on 1 October 2026 and lists the always-free allowance of 6 versions, 10,000 accesses and 3 rotation notifications a month.", "The subprocessor page was last modified on 20 August 2026 and links the Cloud Data Processing Addendum." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/google-secret-manager.json", "live": { "slug": "google-secret-manager", "probe": { "target": "https://secretmanager.googleapis.com/v1", "method": "get", "lastAt": "2026-10-04T23:48:08.987529648Z", "lastOk": true, "lastStatus": 404, "lastMs": 30, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 32, "p95ms24h": 71, "samples24h": 272, "samples30d": 898, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 270, "ok": 270 } ] }, "versions": [ { "registry": "github", "name": "googleapis/google-cloud-python", "version": "sqlalchemy-bigquery-v1.17.3", "released": "2026-10-02", "seenAt": "2026-10-04T16:28:49.436472732Z" }, { "registry": "npm", "name": "@google-cloud/secret-manager", "version": "7.1.1", "seenAt": "2026-10-04T16:28:48.415664025Z" }, { "registry": "pypi", "name": "google-cloud-secret-manager", "version": "2.31.0", "released": "2026-10-01", "seenAt": "2026-10-04T16:28:49.252525474Z" } ], "githubStars": 5400, "npmWeekly": 4594649, "pypiWeekly": 13607832, "securityTxt": { "url": "https://google.com/.well-known/security.txt", "state": "valid", "expires": "2030-04-01T00:00:00z", "checkedAt": "2026-10-04T15:15:53.387118101Z" }, "domain": { "domain": "google.com", "registered": "1997-09-15", "source": "https://rdap.verisign.com/com/v1/domain/google.com", "checkedAt": "2026-10-04T13:05:50.737985829Z" }, "pages": [ { "url": "https://docs.cloud.google.com/secret-manager/docs/release-notes", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:27.397826729Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "3ec2c74e5d97" }, { "url": "https://cloud.google.com/secret-manager/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:41:57.453677516Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e746ddcf80cb" } ], "updatedAt": "2026-10-04T23:48:08.987529648Z" } }, "b": { "slug": "hashicorp-vault", "name": "HashiCorp Vault + Vault MCP Server", "vendor": "HashiCorp (IBM)", "vendorUrl": "https://developer.hashicorp.com/vault", "kind": "http-api", "category": "secrets", "summary": "Secrets management platform for storing credentials and controlling application access.", "url": "https://www.anchorterminal.com/tools/hashicorp-vault", "markdownUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json", "repo": "https://github.com/hashicorp/vault", "license": "BUSL-1.1 (Vault), MPL-2.0 (MCP server)", "transports": [ "http", "stdio", "streamable-http" ], "packages": [], "auth": "mixed", "authNotes": "Every request carries a Vault token in `X-Vault-Token` (or as an HTTP bearer token). Machines get a token from an auth method such as AppRole, Kubernetes, JWT/OIDC, AWS, GCP, Azure, TLS certificates and more. Enterprise 2.0.3+ lets a registered agent present an OAuth 2.0 JWT from your identity provider directly, with RAR claims (RFC 9396) narrowing paths. The MCP server reads VAULT_ADDR, VAULT_TOKEN and VAULT_NAMESPACE, or takes them as headers in HTTP mode.", "pricing": "freemium", "pricingNotes": "Vault Community is free to run under the BUSL-1.1, which forbids selling a competing hosted product. HCP Vault Dedicated is hourly per cluster on the IBM price list. Development extra small $0.61644 an hour, Essentials small $1.57799, medium $3.16299, large $7.48857, Standard small $1.84299, medium $3.69099, large $9.40599, plus $72.92 a month per product client. Prices are indicative and exclude tax. Vault Enterprise self-managed is quoted, and the 2.1.0 licence added Agentic IAM terms. HCP has a $500 pay-as-you-go credit (https://www.ibm.com/products/hashicorp/pricing, https://www.hashicorp.com/en/pricing).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "endpoints": [] }, "toolCount": 16, "popularity": { "githubStars": 36234, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://developer.hashicorp.com/vault/docs", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host", "auth.agent-identity" ], "tags": [ "hosted", "self-hosted", "source-available", "freemium", "mcp", "local", "go", "enterprise", "eu" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 64.4, "grade": "B", "agentReady": false, "rank": 184, "ranked": true, "rankOf": 452, "categoryRank": 7, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 77, "payments": 30, "reliability": 71, "schema": 74, "security": 86, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -5, "negativeNotes": [ "-4: The official Vault MCP server fixed cross-user credential inheritance through a shared MCP session ID on 2026-07-28 and an SSRF through a VAULT_ADDR query parameter on 2026-08-11, but the newest binary and Docker image are still 0.2.0 from 2025-09-24 and no advisory was published (https://github.com/hashicorp/vault-mcp-server/commits/main, https://releases.hashicorp.com/vault-mcp-server/)", "-1: Vault 2.0.3 (2026-06-17) fixed a LIST ACL bypass where a trailing slash skipped a more specific deny rule; fixed and documented in the changelog, so it decays (https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)" ], "verdict": "Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.", "strengths": [ "Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after", "Path policies with explicit deny, audit devices on every edition, and Agent Registry with ceiling policies on Enterprise", "Auth methods for every major cloud, Kubernetes, JWT/OIDC and AppRole", "Three releases between 4 August and 16 September 2026 with a dated changelog that names each CVE fixed", "Each server generates its own OpenAPI document at /v1/sys/internal/specs/openapi" ], "weaknesses": [ "The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased", "Agentic IAM, control groups and the OAuth resource server are Enterprise only", "BUSL-1.1, not an OSI licence, and HCP Vault Secrets was retired within two years of launch", "No llms.txt, and the only official client library is Go", "HCP client pricing ($72.92 a client a month) can dwarf the cluster price for many agents, and no SLA is published" ], "agentNotes": [ "Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call", "Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request", "For KV v2, GET /v1/\u003cmount\u003e/data/\u003cpath\u003e and read data.data, and pass cas on writes so a retry can't overwrite a newer version", "If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount", "Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.4 } ], "editorialScores": { "ergonomics": 64, "maintenance": 77, "payments": 30, "reliability": 71, "schema": 74, "security": 86, "transparency": 65 }, "provenanceScore": 100 }, "connect": { "install": "docker run --rm -p 8200:8200 hashicorp/vault server -dev # or download vault-mcp-server from releases.hashicorp.com", "http": "curl -H \"X-Vault-Token: $VAULT_TOKEN\" \"$VAULT_ADDR/v1/secret/data/myapp\"", "claudeCode": "claude mcp add vault -e VAULT_ADDR=$VAULT_ADDR -e VAULT_TOKEN=$VAULT_TOKEN -- vault-mcp-server stdio", "config": { "mcpServers": { "vault": { "args": [ "run", "-i", "--rm", "-e", "VAULT_ADDR", "-e", "VAULT_TOKEN", "hashicorp/vault-mcp-server" ], "command": "docker", "env": { "VAULT_ADDR": "${VAULT_ADDR}", "VAULT_TOKEN": "${VAULT_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/hashicorp-vault" }, "sameCompany": [ "terraform-mcp" ], "area": "agent-runtime", "unitPrices": [ { "item": "HCP Vault Dedicated, product client", "unit": "account-month", "usd": 72.92, "note": "Per client a month, Essentials and Standard" } ], "provenance": { "legalEntity": "HashiCorp, Inc. (an IBM company)", "domain": "hashicorp.com", "domainRegistered": "2011-04-30", "endpointOnVendorDomain": true, "terms": "https://www.hashicorp.com/en/terms-of-service", "privacy": "https://www.hashicorp.com/en/privacy", "statusPage": "https://status.hashicorp.com", "changelog": "https://github.com/hashicorp/vault/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The website terms name HashiCorp, Inc. and were last updated March 2018. The privacy policy (20 April 2026) gives HashiCorp, an IBM Company, c/o 1 North Castle Drive, Armonk, New York, and notes the IBM acquisition closed on 27 February 2025.", "security.txt has Contact, Policy and Encryption but no Expires field.", "HCP prices come from the IBM price table and are marked indicative, varying by country.", "status.hashicorp.com runs on incident.io. From 1 July to 1 October 2026 it posted nothing against HCP Vault Dedicated; it did post a DR cluster creation failure on HCP (6 August) and a releases.hashicorp.com outage (26 September).", "The Vault MCP server's newest published build is 0.2.0 (24 September 2025) on releases.hashicorp.com and Docker Hub, although its VERSION file and changelog say 0.2.1." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hashicorp-vault.json", "live": { "slug": "hashicorp-vault", "vendorStatus": { "page": "https://status.hashicorp.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:49:15.610935414Z" }, "versions": [ { "registry": "github", "name": "hashicorp/vault", "version": "v2.1.1", "released": "2026-09-16", "seenAt": "2026-10-04T16:29:29.320950791Z" } ], "githubStars": 36339, "securityTxt": { "url": "https://hashicorp.com/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-10-04T15:16:00.556489725Z" }, "domain": { "domain": "hashicorp.com", "registered": "2011-04-30", "source": "https://rdap.verisign.com/com/v1/domain/hashicorp.com", "checkedAt": "2026-10-04T13:10:23.718306751Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/hashicorp/vault/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-04T15:47:41.235618427Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0620845f2f7e" }, { "url": "https://www.ibm.com/support/pages/hcp-vault-secrets-end-life", "kind": "deprecations", "status": 304, "checkedAt": "2026-10-04T15:50:50.575718841Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e24e2e2b51c3" }, { "url": "https://www.hashicorp.com/en/pricing", "kind": "pricing", "status": 429, "checkedAt": "2026-10-04T15:50:36.37620806Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.ibm.com/products/hashicorp/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:50:46.127664694Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0e262eb503c4" }, { "url": "https://www.hashicorp.com/en/privacy", "kind": "privacy", "status": 429, "checkedAt": "2026-10-04T15:50:38.389849123Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.hashicorp.com/en/terms-of-service", "kind": "terms", "status": 429, "checkedAt": "2026-10-04T15:50:40.386204192Z", "changedAt": "0001-01-01T00:00:00Z" } ], "updatedAt": "2026-10-04T23:49:15.610935414Z" } }, "summary": "Google Cloud Secret Manager has a score of 76.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is agent ergonomics, 18 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault", "json": "https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md", "slim": "https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.min.md" }, "markdown": "Google Cloud Secret Manager has a score of 76.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is agent ergonomics, 18 points.\n\n- Google Cloud Secret Manager: grade BB, 76.6/100, rank #26 of 452. Markdown https://www.anchorterminal.com/tools/google-secret-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/google-secret-manager.json\n- HashiCorp Vault + Vault MCP Server: grade B, 64.4/100, rank #184 of 452. Markdown https://www.anchorterminal.com/tools/hashicorp-vault.md · JSON https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json\n\n## Which one, for what\n\nPick Google Cloud Secret Manager for reliability (+16), schema \u0026 documentation (+9), agent ergonomics (+18), maintenance \u0026 community (+10).\n\nPick HashiCorp Vault + Vault MCP Server for payments \u0026 pricing (+10).\n\n## Score by category\n\n| Category | Weight | Google Cloud Secret Manager | HashiCorp Vault + Vault MCP Server | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 71 | Google Cloud Secret Manager +16 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 83 | 74 | Google Cloud Secret Manager +9 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 64 | Google Cloud Secret Manager +18 |\n| Security \u0026 auth | 14% (17.5 this run) | 85 | 86 | HashiCorp Vault + Vault MCP Server +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 30 | HashiCorp Vault + Vault MCP Server +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 77 | Google Cloud Secret Manager +10 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 85 | 83 | Google Cloud Secret Manager +2 |\n| Negative events | ≤15 | 0 | -5 | |\n| **Total** | | **76.6 · BB** | **64.4 · B** | |\n\n## Facts side by side\n\n| Fact | Google Cloud Secret Manager | HashiCorp Vault + Vault MCP Server |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Google Cloud | HashiCorp (IBM) |\n| Hosted endpoint | `https://secretmanager.googleapis.com/v1` | no (local only) |\n| Transports | HTTP | HTTP, stdio, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 (client libraries) | BUSL-1.1 (Vault), MPL-2.0 (MCP server) |\n| Tools exposed | none | 16 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-14 | 2026-09-16 |\n| Popularity | 4.2M npm/wk, 13.6M PyPI/wk | 36k stars |\n| Agent reviews | 3.6/5 (8) | 3/5 (2) |\n\n## Verdicts\n\n**Google Cloud Secret Manager.** Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.\n\n**HashiCorp Vault + Vault MCP Server.** Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.\n\n## Before you call either\n\n### Google Cloud Secret Manager\n\n1. Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version\n2. Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent\n3. Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read\n4. Read once per run and cache; accesses past 10,000 a month are metered\n5. Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there\n\n### HashiCorp Vault + Vault MCP Server\n\n1. Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call\n2. Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request\n3. For KV v2, GET /v1/\u003cmount\u003e/data/\u003cpath\u003e and read data.data, and pass cas on writes so a retry can't overwrite a newer version\n4. If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount\n5. Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After\n\n## Other comparisons with Google Cloud Secret Manager or HashiCorp Vault + Vault MCP Server\n\n- [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)\n- [Akeyless (SecretlessAI and MCP server) vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/akeyless-vs-google-secret-manager.md)\n- [Akeyless (SecretlessAI and MCP server) vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/akeyless-vs-hashicorp-vault.md)\n- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)\n- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)\n- [Bitwarden Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-google-secret-manager.md)\n- [Bitwarden Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-hashicorp-vault.md)\n- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)\n- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)\n- [Google Cloud Secret Manager vs Infisical](https://www.anchorterminal.com/compare/google-secret-manager-vs-infisical.md)\n- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server", "url": "" } ], "description": "Google Cloud Secret Manager has a score of 76.6 (BB) against HashiCorp Vault + Vault MCP Server's 64.4 (B). Both do secrets store. The largest gap is agent ergonomics, 18 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Google Cloud Secret Manager BB 76.6", "HashiCorp Vault + Vault MCP Server B 64.4", "scores" ], "h1": "Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server", "image": "https://www.anchorterminal.com/assets/og/compare-google-secret-manager-vs-hashicorp-vault.png", "path": "/compare/google-secret-manager-vs-hashicorp-vault", "published": "2026-10-01", "section": "tools", "title": "Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault" }, "tokens": { "markdown": 1800, "slim": 380 }, "version": 1 }