Delinea MCP Server – Secret Server Access

Delinea MCP Server is Delinea's official open source Model Context Protocol server for connecting AI agents to Delinea Secret Server and selected Delinea Platform APIs. It enables controlled access to secrets, folders, reports, users, groups, roles, access requests, and related administrative workflows while preserving identity context, policy checks, and auditability.

#secrets#identity#pam

Overview

Delinea MCP Server is an official open source MCP server from Delinea for Delinea Secret Server and Delinea Platform APIs. It gives compatible AI clients a structured way to interact with privileged access management workflows without copying vault credentials directly into prompts. Delinea describes the server as a way to connect AI agents with Delinea Platform capabilities while protecting credentials, applying identity context, and maintaining traceability.

What the MCP server enables

The server exposes tools for Secret Server and optional Delinea Platform administration. Documented tools include retrieving secrets and summaries, searching secrets, users, and folders, fetching folder metadata, running Secret Server reports, handling pending access requests, reading inbox messages, managing users, roles, groups, folders, memberships, and checking service health. It also includes ChatGPT compatibility tools named search and fetch, with configurable object types.

When to use it

Use this server when an AI assistant needs to help with PAM and identity-security operations that rely on Delinea data. Practical workflows include locating a vaulted secret, summarizing folder contents, checking pending access requests, generating a report from Secret Server data, reviewing active users, or assisting an administrator with user, role, group, and folder operations. Because many tools can read or modify sensitive identity and secret-management resources, it should be enabled only for trusted clients and tightly scoped use cases.

Connection and authentication

Delinea documents two supported MCP transport modes: stdio for local command-line clients and sse for HTTP/SSE deployments. Local setup uses Python with uv, synchronizes requirements.txt, and starts the server with uv run server.py --config config.json. Non-secret settings such as the Secret Server base URL, username, transport mode, port, OAuth mode, and enabled tool list belong in config.json; secrets such as DELINEA_PASSWORD and optional PLATFORM_SERVICE_PASSWORD are supplied through environment variables.

Key considerations

The server can register all tools when enabled_tools is empty, but Delinea's repository recommends enabling tools selectively per task. OAuth is supported only with SSE transport. The repository also notes that the included OAuth endpoints are intended for development and testing and that production deployments must restrict approved redirect URIs to prevent authorization-code capture. Streaming HTTP is listed on the roadmap, so this YAML includes only the currently documented stdio and sse transports.

Frequently Asked Questions

When should an AI agent use Delinea MCP Server?

Use it when an AI agent needs controlled access to Delinea Secret Server or supported Delinea Platform workflows, such as finding vaulted secrets, reviewing folders, handling access requests, checking health status, or assisting with user, role, group, and folder administration.

What does Delinea MCP Server add to an AI agent's capabilities?

It gives the agent live, permission-bound tools for Delinea Secret Server and optional Delinea Platform APIs, including secret lookup, reporting, inbox and access-request helpers, user and group administration, role management, folder management, and ChatGPT-compatible search and fetch tools.

What can the AI agent access or manage through this server?

The documented tools cover Secret Server secrets, folders, templates, reports, users, groups, roles, group memberships, role assignments, inbox messages, pending access requests, and health checks. Platform user-management tools are optional and require platform-specific configuration and credentials.

How is authentication configured for Delinea MCP Server?

Non-secret settings are stored in `config.json`, including Delinea username, Secret Server base URL, transport mode, OAuth mode, port, and enabled tools. Passwords and service credentials are supplied as environment variables such as `DELINEA_PASSWORD` and, for Platform tools, `PLATFORM_SERVICE_PASSWORD` with the matching Platform hostname, service account, and tenant ID settings.

Which transport should be used for Delinea MCP Server?

Use `stdio` for local desktop or command-line MCP clients. Use `sse` when hosting the server over HTTP for remote clients or OAuth-based access. OAuth requires SSE mode, while streaming HTTP is not included because Delinea lists it as a roadmap item rather than a current transport.