HashiCorp Boundary MCP Server (official, beta)

70/100

Capped at 70: no passing tool call yet; the tests add up to 75. Why scores are capped

Last tested 2026-10-29 (Fresh: tested within 30 days) Needs credentialsNo tool call tested yet API key

Advisories: not yet checked

Security review: not tested

Test points add up to 75; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology

Test points before the cap (75/100)

  • Install20/20
  • Handshake5/30
  • Maintenance25/25
  • Docs15/15
  • License10/10

Local HTTP server, no public repo
Runs on your own machine; downloaded from HashiCorp; source isn't public, so it's held from rankings until an editorial check.
Sources: https://developer.hashicorp.com/boundary/docs/mcp-server/run · https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/boundary-mcp-server_0.1.0-beta_linux_amd64.zip · https://developer.hashicorp.com/boundary/docs/mcp-server · https://developer.hashicorp.com/boundary/docs/mcp-server/configure-clients · https://api.releases.hashicorp.com/v1/releases/boundary-mcp-server/0.1.0-beta

Transport: Streamable HTTP · not tested

Score 70/100 · Tools — · Token cost — · Compare · Last tested 2026-10-29 · Version tested 0.1.0-beta · Package boundary-mcp-server

Summary: HashiCorp Boundary MCP Server (official, beta) requires credentials or a backing service before it will list tools.

Evidence summary

Handshake
auth-gated
Tools listed
—
Context cost
Not measured ranking
API key
Needs a key
Tested
2026-10-29

Test results

TestResultPointsEvidence
installpass20Official download linked from the vendor's site (https://developer.hashicorp.com/boundary/docs/mcp-server/run): download boundary-mcp-server_0.1.0-beta_linux_amd64.zip from https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/, sha256 62b7fe0120a7052f044fad43975b6889073cf462b59bb8d91afeb16bcebc309b matched boundary-mcp-server_0.1.0-beta_SHA256SUMS; GPG signature good (HashiCorp key), unzip; took 0.4s. Local HTTP rule: sha256 matched the vendor's published checksums (https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/boundary-mcp-server_0.1.0-beta_SHA256SUMS).
handshakeauth-gated5Auth-gated: server started on http://127.0.0.1:18765 (localhost only); MCP initialize without credentials returned HTTP 401 ("BOUNDARY_TOKEN header not set"). Not tested with real credentials; not counted as working. The binary's own list-tools command lists 118 registrable tools (not an MCP handshake, not scored).
maintenancepass25Local HTTP rule: vendor-dated release (releases API timestamp_created) 2026-10-27 (https://api.releases.hashicorp.com/v1/releases/boundary-mcp-server/0.1.0-beta), 2 days before test. No public repo, so no stars, issues or push activity are counted.
docspass15official vendor docs page; states the localhost run command/endpoint; client setup instructions. Local HTTP rule: scored from the vendor's docs (https://developer.hashicorp.com/boundary/docs/mcp-server, https://developer.hashicorp.com/boundary/docs/mcp-server/run, https://developer.hashicorp.com/boundary/docs/mcp-server/configure-clients).
licensepass10MPL-2.0 (OSI-approved), cited from the vendor-dated release zip 2026-10-27 (https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/boundary-mcp-server_0.1.0-beta_linux_amd64.zip).

Local-model readiness

Not yet tested (no tools/list response without credentials).

What we tested and what we didn't

Tested on 2026-10-29

  • Install from the registry
  • We attempted an MCP initialize with no credentials and got HTTP 401, so we never reached the tool list (Method details: initialize POST answered 401; tools/list not sent)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that it is safe to give it access to your data.

Known security issues

Not yet checked.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

No tool list: this server did not list tools without credentials in our test, so tool changes are not tracked.

Raw test record (JSON)
{
  "name": "boundary-mcp-server",
  "version": "0.1.0-beta",
  "registry": "local-http",
  "status": "auth-gated",
  "tested": "2026-10-29",
  "tools_count": null,
  "tools_schema_tokens_est": null,
  "deprecated": false,
  "archived": null,
  "tests": {
    "install": [
      "pass",
      20,
      "Official download linked from the vendor's site (https://developer.hashicorp.com/boundary/docs/mcp-server/run): download boundary-mcp-server_0.1.0-beta_linux_amd64.zip from https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/, sha256 62b7fe0120a7052f044fad43975b6889073cf462b59bb8d91afeb16bcebc309b matched boundary-mcp-server_0.1.0-beta_SHA256SUMS; GPG signature good (HashiCorp key), unzip; took 0.4s. Local HTTP rule: sha256 matched the vendor's published checksums (https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/boundary-mcp-server_0.1.0-beta_SHA256SUMS)."
    ],
    "handshake": [
      "auth-gated",
      5,
      "Auth-gated: server started on http://127.0.0.1:18765 (localhost only); MCP `initialize` without credentials returned HTTP 401 (\"BOUNDARY_TOKEN header not set\"). Not tested with real credentials; not counted as working. The binary's own `list-tools` command lists 118 registrable tools (not an MCP handshake, not scored)."
    ],
    "maintenance": [
      "pass",
      25,
      "Local HTTP rule: vendor-dated release (releases API timestamp_created) 2026-10-27 (https://api.releases.hashicorp.com/v1/releases/boundary-mcp-server/0.1.0-beta), 2 days before test. No public repo, so no stars, issues or push activity are counted."
    ],
    "docs": [
      "pass",
      15,
      "official vendor docs page; states the localhost run command/endpoint; client setup instructions. Local HTTP rule: scored from the vendor's docs (https://developer.hashicorp.com/boundary/docs/mcp-server, https://developer.hashicorp.com/boundary/docs/mcp-server/run, https://developer.hashicorp.com/boundary/docs/mcp-server/configure-clients)."
    ],
    "license": [
      "pass",
      10,
      "MPL-2.0 (OSI-approved), cited from the vendor-dated release zip 2026-10-27 (https://releases.hashicorp.com/boundary-mcp-server/0.1.0-beta/boundary-mcp-server_0.1.0-beta_linux_amd64.zip)."
    ]
  }
}

Install

boundary-mcp-server --addr 127.0.0.1:8080

Tools listed

Not available (handshake did not complete without credentials).

Quick config

{
  "mcpServers": {
    "hashicorp-boundary-mcp-server-official-beta": {
      "type": "http",
      "url": "http://127.0.0.1:8080",
      "env": {
        "BOUNDARY_TOKEN": "<your key>"
      }
    }
  }
}

API key: set BOUNDARY_TOKEN in env (replace <your key>). Our handshake ran without it; real use needs it.

Add to config Opens the config generator with this server selected.

Setup

Without credentials it said (verbatim): BOUNDARY_TOKEN header not set

Env var seen in our test: BOUNDARY_TOKEN

  1. Install. No install step: it is a remote server at http://127.0.0.1:18765.
  2. Configure. Add the mcpServers entry below to your MCP client config and set BOUNDARY_TOKEN.
  3. Verify. Restart the client and check that tools/list returns tools. In our test it did not list tools without credentials.
{
  "mcpServers": {
    "hashicorp-boundary-mcp-server-official-beta": {
      "type": "http",
      "url": "http://127.0.0.1:8080",
      "env": {
        "BOUNDARY_TOKEN": "<your key>"
      }
    }
  }
}

Not tested with credentials We have not tested this with real credentials.

Test history

No dated events yet.

Follow this server (RSS) · Monthly changelog

Related: MCP servers that need an API key · How to secure AI API keys

FAQ

Is HashiCorp Boundary MCP Server (official, beta) deprecated?

No. boundary-mcp-server was not deprecated or archived when we last tested it on 2026-10-29.

What replaces HashiCorp Boundary MCP Server (official, beta)?

Nothing; HashiCorp Boundary MCP Server (official, beta) is not deprecated as of 2026-10-29.

Does HashiCorp Boundary MCP Server (official, beta) need an API key?

Yes. Without credentials it only printed a missing-credential message and did not list tools (auth-gated).

Embed the badge

TestedMCP: 70/100, tested 2026-10-29

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue