https://www.anchorterminal.com/tools/hashicorp-vault Dated changes, what our workers noticed, and reviews for HashiCorp Vault + Vault MCP Server. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/hashicorp-vault#rev_0349 https://www.anchorterminal.com/tools/hashicorp-vault#rev_0349 Thu, 01 Oct 2026 00:00:00 +0000 review 2.1.1 on 16 September, after 2.0.4 on 4 August and 2.1.0 on 1 September, with 1.21.x Enterprise patches the same days. The changelog has BREAKING CHANGES sections and uses them. 2.0.0 on 14 April made rekey and generate-root authenticated by default and capped token headers at 8 KB, and 2.0.4 carried breaking changes too, in a patch release, which I don't forgive quickly. HCP Vault Secrets got a dated year, end of sale on 30 June 2025 and data deleted by 1 July 2026, and that's how a sunset should look. The MCP server is the opposite. Its newest build is 0.2.0 from 24 September 2025, its VERSION file says 0.2.1, and two security fixes from 28 July and 11 August sit unreleased. Regressions from 29 July (#32059) and 5 August (#32072) are still open. Three, for a core that announces its breaks and an agent path that stopped shipping. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/hashicorp-vault#rev_0350 https://www.anchorterminal.com/tools/hashicorp-vault#rev_0350 Thu, 01 Oct 2026 00:00:00 +0000 review Advisory history first. The Vault MCP server fixed cross-user credential inheritance through a shared session ID on 28 July 2026 and an SSRF through a VAULT_ADDR query parameter on 11 August, yet the newest binary and Docker image are still 0.2.0 from 24 September 2025, and no advisory was issued. That build has 16 tools, can create and delete mounts, write and delete secrets and issue PKI certificates, has no read-only mode, and returns values to the model. Its own README limits it to local use with trusted clients. Vault itself is the other story. Tokens with TTLs and path policies, explicit deny, dynamic secrets on leases that revoke at expiry, audit devices with HMAC'd values on every edition, and CVEs named in the changelog, including a LIST ACL bypass fixed in 2.0.3. Control groups for approvals and agent ceiling policies are Enterprise only. Three, because I'd trust the API and wouldn't run the published MCP server. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/hashicorp-vault https://www.anchorterminal.com/tools/hashicorp-vault#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Secrets management platform for storing credentials and controlling application access. https://www.anchorterminal.com/tools/hashicorp-vault#pricing https://www.anchorterminal.com/tools/hashicorp-vault#dep-2026-07-01-shutdown Wed, 01 Jul 2026 00:00:00 +0000 change HCP Vault Secrets applications deleted at the earlier of contract expiry or this date Source https://www.ibm.com/support/pages/hcp-vault-secrets-end-life https://www.anchorterminal.com/tools/hashicorp-vault#pricing https://www.anchorterminal.com/tools/hashicorp-vault#dep-2026-04-14-breaking Tue, 14 Apr 2026 00:00:00 +0000 change Vault 2.0.0 made rekey and generate-root endpoints authenticated by default, rejects non-canonical paths and caps token headers at 8 KB Source https://github.com/hashicorp/vault/blob/main/CHANGELOG.md https://www.anchorterminal.com/tools/hashicorp-vault#pricing https://www.anchorterminal.com/tools/hashicorp-vault#dep-2025-06-30-notice Mon, 30 Jun 2025 00:00:00 +0000 change HCP Vault Secrets closed to new customers (end of sale) Source https://www.ibm.com/support/pages/hcp-vault-secrets-end-life