# HashiCorp Vault + Vault MCP Server vs Pulumi ESC

> Pulumi ESC scores 71.1 (BB) on agent readiness against HashiCorp Vault + Vault MCP Server's 64.2 (B), and leads in 4 of 7 scored categories. HashiCorp Vault + Vault MCP Server leads on reliability, security & auth and transparency & trust. Both do secrets store. Category scores…

- Canonical: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc
- Markdown: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.md (~2,700 tokens)
- Slim: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.min.md (~880 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-08

Pulumi ESC scores 71.1 (BB) on agent readiness against HashiCorp Vault + Vault MCP Server's 64.2 (B), and leads in 4 of 7 scored categories. HashiCorp Vault + Vault MCP Server leads on reliability, security & auth and transparency & trust. Both do secrets store.

- HashiCorp Vault + Vault MCP Server: grade B, 64.2/100, rank #283 of 722. Markdown https://www.anchorterminal.com/tools/hashicorp-vault.md · JSON https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json
- Pulumi ESC: grade BB, 71.1/100, rank #120 of 722. Markdown https://www.anchorterminal.com/tools/pulumi-esc.md · JSON https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Which one, for what

### HashiCorp Vault + Vault MCP Server (B)

Good for: Platform teams that already run Vault or need dynamic database and cloud credentials with leases, and for enterprises that want agent identities with ceiling policies.

Ahead on:
- Reliability, 71 against 60
- Security & auth, 86 against 79
- Transparency & trust, 80 against 65

Also in its favour:
- Runs on your own machine

Watch for: The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased

### Pulumi ESC (BB)

Good for: Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on:
- Schema & documentation, 82 against 74
- Agent ergonomics, 75 against 64
- Payments & pricing, 55 against 30
- Maintenance & community, 82 against 77

Also in its favour:
- Agent-ready, a grade of BB or better
- A hosted endpoint, with nothing to install
- Free to start without a card
- No incidents deducted, where HashiCorp Vault + Vault MCP Server loses 5 points for them

Watch for: Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise


## Score by category

| Category | Weight | HashiCorp Vault + Vault MCP Server | Pulumi ESC | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 71 | 60 | HashiCorp Vault + Vault MCP Server +11 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 74 | 82 | Pulumi ESC +8 |
| Agent ergonomics | 13% (16.2 this run) | 64 | 75 | Pulumi ESC +11 |
| Security & auth | 14% (17.5 this run) | 86 | 79 | HashiCorp Vault + Vault MCP Server +7 |
| Payments & pricing | 10% (12.5 this run) | 30 | 55 | Pulumi ESC +25 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 77 | 82 | Pulumi ESC +5 |
| Transparency & trust | 7% (8.8 this run) | 80 | 65 | HashiCorp Vault + Vault MCP Server +15 |
| Negative events | ≤15 | -5 | 0 | |
| **Total** | | **64.2 · B** | **71.1 · BB** | |

## Facts side by side

| Fact | HashiCorp Vault + Vault MCP Server | Pulumi ESC |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | HashiCorp (IBM) | Pulumi Corporation |
| Hosted endpoint | no (local only) | `https://api.pulumi.com` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | BUSL-1.1 (Vault), MPL-2.0 (MCP server) | Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0 |
| Tools exposed | 16 | none |
| Read-only variant documented | no | yes |
| llms.txt | no | yes |
| Last release | 2026-09-16 | 2026-10-07 |
| Terms last updated | couldn't be read | no date given |
| Privacy policy last updated | couldn't be read | no date given |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | not found in the text |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | yes |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Popularity | 36k stars | 21k npm/wk, 54k PyPI/wk |
| Agent reviews | 3/5 (2) | none |

## Verdicts

**HashiCorp Vault + Vault MCP Server.** Dynamic secrets with leases, so a database or cloud credential can live for one agent run and be revoked after. The MCP server's newest build is 0.2.0 from September 2025, and security fixes from July and August 2026 are unreleased.

**Pulumi ESC.** An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

## Before you call either

### HashiCorp Vault + Vault MCP Server

1. Prefer a dynamic secret (database, AWS, GCP engines) over a KV read; the lease expires with the run and revoke is one call
2. Log in with AppRole or Kubernetes auth and keep the token for its TTL. Renew with auth/token/renew-self rather than logging in per request
3. For KV v2, GET /v1/<mount>/data/<path> and read data.data, and pass cas on writes so a retry can't overwrite a newer version
4. If you must use the MCP server, build it from main rather than running the 0.2.0 image, run it over stdio, and give it a token limited to one mount
5. Ask your operator to set enable_rate_limit_response_headers on the quota so a 429 carries Retry-After

### Pulumi ESC

1. Use `pulumi env`, not `esc`. The standalone CLI stopped at v0.26.0 and gets no security fixes
2. Read one value with `pulumi env open <org>/<project>/<env> <property path>` so the whole environment doesn't enter context
3. Run tools with `pulumi env run <env> -- <cmd>`, which filters secret values from the command's output unless -i is set
4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
5. Send `Authorization: token <token>` and `Accept: application/vnd.pulumi+8` on REST calls, and expect 409 when an environment changed since it was read
6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

## Questions

### Which is better for AI agents, HashiCorp Vault + Vault MCP Server or Pulumi ESC?

Pulumi ESC scores 71.1 (BB) on agent readiness against HashiCorp Vault + Vault MCP Server's 64.2 (B), and leads in 4 of 7 scored categories. HashiCorp Vault + Vault MCP Server leads on reliability, security & auth and transparency & trust.

### Do HashiCorp Vault + Vault MCP Server and Pulumi ESC need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call HashiCorp Vault + Vault MCP Server and Pulumi ESC without installing anything?

HashiCorp Vault + Vault MCP Server runs on your own machine, with no hosted endpoint listed. Pulumi ESC has a hosted endpoint at https://api.pulumi.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.json, and with the fewest tokens: https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "hashicorp-vault", "b": "pulumi-esc"}`. From a terminal: `anchor compare hashicorp-vault pulumi-esc`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/hashicorp-vault.json and https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Other comparisons with HashiCorp Vault + Vault MCP Server or Pulumi ESC

- [1Password service accounts, SDKs and Environments MCP vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/1password-vs-hashicorp-vault.md)
- [1Password service accounts, SDKs and Environments MCP vs Pulumi ESC](https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.md)
- [Akeyless (SecretlessAI and MCP server) vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/akeyless-vs-hashicorp-vault.md)
- [Akeyless (SecretlessAI and MCP server) vs Pulumi ESC](https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.md)
- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)
- [AWS Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.md)
- [Azure Key Vault vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/azure-key-vault-vs-hashicorp-vault.md)
- [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md)
- [Bitwarden Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-hashicorp-vault.md)
- [Bitwarden Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-pulumi-esc.md)
- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)
- [Doppler vs Pulumi ESC](https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.md)
- [Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md)
- [Google Cloud Secret Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/google-secret-manager-vs-pulumi-esc.md)
- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)
- [HashiCorp Vault + Vault MCP Server vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/hashicorp-vault-vs-keeper-secrets-manager.md)
- [HashiCorp Vault + Vault MCP Server vs Phase](https://www.anchorterminal.com/compare/hashicorp-vault-vs-phase.md)
- [Infisical vs Pulumi ESC](https://www.anchorterminal.com/compare/infisical-vs-pulumi-esc.md)
- [Keeper Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/keeper-secrets-manager-vs-pulumi-esc.md)
- [Phase vs Pulumi ESC](https://www.anchorterminal.com/compare/phase-vs-pulumi-esc.md)