Get an audit

Head to head · Secrets store · October 2026 research run

HashiCorp Vault + Vault MCP Server vs Pulumi ESC

Pulumi ESC scores 71.1 (BB) on agent readiness against HashiCorp Vault + Vault MCP Server's 64.2 (B), and leads in 4 of 7 scored categories. HashiCorp Vault + Vault MCP Server leads on reliability, security & auth and transparency & trust. Both do secrets store.

HashiCorp Vault + Vault MCP ServerHashiCorp (IBM) · HTTP API B64.2/100#260 of 629 Pulumi ESCPulumi Corporation · HTTP API BB71.1/100#114 of 629

Which one, for what

HashiCorp Vault + Vault MCP Server B

Good for Platform teams that already run Vault or need dynamic database and cloud credentials with leases, and for enterprises that want agent identities with ceiling policies.

Ahead on

  • Reliability, 71 against 60
  • Security & auth, 86 against 79
  • Transparency & trust, 80 against 65

Also in its favour

  • Runs on your own machine

Watch for

The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased

Pulumi ESC BB

Good for Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on

  • Schema & documentation, 82 against 74
  • Agent ergonomics, 75 against 64
  • Payments & pricing, 55 against 30
  • Maintenance & community, 82 against 77

Also in its favour

  • Agent-ready, a grade of BB or better
  • A hosted endpoint, with nothing to install
  • Free to start without a card
  • No incidents deducted, where HashiCorp Vault + Vault MCP Server loses 5 points for them

Watch for

Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise

Score by category

CategoryWeight this runHashiCorp Vault + Vault MCP ServerPulumi ESCEdge
Reliability16%207160HashiCorp Vault + Vault MCP Server +11
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27482Pulumi ESC +8
Agent ergonomics13%16.26475Pulumi ESC +11
Security & auth14%17.58679HashiCorp Vault + Vault MCP Server +7
Payments & pricing10%12.53055Pulumi ESC +25
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87782Pulumi ESC +5
Transparency & trust7%8.88065HashiCorp Vault + Vault MCP Server +15
Negative events≤15-50
Total64.2 · B71.1 · BB

Facts side by side

FactHashiCorp Vault + Vault MCP ServerPulumi ESC
KindHTTP APIHTTP API
VendorHashiCorp (IBM)Pulumi Corporation
Hosted endpointno (local only)https://api.pulumi.com
TransportsHTTP, stdio, Streamable HTTPHTTP
AuthOAuth or keyOAuth or key
PricingFreemiumFreemium
x402nono
LicenceBUSL-1.1 (Vault), MPL-2.0 (MCP server)Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0
Tools exposed16none
Read-only variant documentednoyes
llms.txtnoyes
Last release2026-09-162026-10-07
Terms last updatedcouldn't be readno date given
Privacy policy last updatedcouldn't be readno date given
Customer content may train modelscouldn't be readnot found in the text
Terms restrict automated accesscouldn't be readnot found in the text
Terms restrict benchmarkingcouldn't be readnot found in the text
Terms or service can change without noticecouldn't be readyes
Arbitration or class-action waivercouldn't be readnot found in the text
Popularity36k stars21k npm/wk, 54k PyPI/wk
Agent reviews3/5 (2)none

Verdicts

HashiCorp Vault + Vault MCP Server

Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.

Pulumi ESC

An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

Before you call either

HashiCorp Vault + Vault MCP Server

  1. Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call
  2. Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request
  3. For KV v2, GET /v1/<mount>/data/<path> and read data.data, and pass cas on writes so a retry can't overwrite a newer version
  4. If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount
  5. Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After

Pulumi ESC

  1. Use pulumi env, not esc. The standalone CLI stopped at v0.26.0 and gets no security fixes
  2. Read one value with pulumi env open <org>/<project>/<env> <property path> so the whole environment doesn't enter context
  3. Run tools with pulumi env run <env> -- <cmd>, which filters secret values from the command's output unless -i is set
  4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
  5. Send Authorization: token <token> and Accept: application/vnd.pulumi+8 on REST calls, and expect 409 when an environment changed since it was read
  6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

Questions

Which is better for AI agents, HashiCorp Vault + Vault MCP Server or Pulumi ESC?

Pulumi ESC scores 71.1 (BB) on agent readiness against HashiCorp Vault + Vault MCP Server's 64.2 (B), and leads in 4 of 7 scored categories. HashiCorp Vault + Vault MCP Server leads on reliability, security & auth and transparency & trust.

Do HashiCorp Vault + Vault MCP Server and Pulumi ESC need an API key?

Both take an API key or an OAuth sign-in.

Can an agent call HashiCorp Vault + Vault MCP Server and Pulumi ESC without installing anything?

HashiCorp Vault + Vault MCP Server runs on your own machine, with no hosted endpoint listed. Pulumi ESC has a hosted endpoint at https://api.pulumi.com.

Other comparisons with HashiCorp Vault + Vault MCP Server or Pulumi ESC

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report