Delinea Released an MCP Server to Put Guardrails Around AI Agents Credential Access

Delinea released an Model Context Protocol (MCP) server that let AI-agent access to credentials stored in Delinea Secret Server and the Delinea Platform. The server applies identity checks and policy rules on every call, aiming to keep long-lived secrets out of agent memory while retaining full auditability

What’s new for me?

The GitHub project DelineaXPM/delinea-mcp (MIT-licensed) exposes a constrained MCP tool surface for credential retrieval and account operations, supports OAuth 2.0 dynamic client registration per the MCP spec, and offers both STDIO and HTTP/SSE transports. The repo includes Docker artifacts and example configs for editor/agent integrations

How it works?

The server exposes MCP tools that proxy to Secret Server and (optionally) the Delinea Platform: secret and folder retrieval/search, inbox/access-request helpers, user/session admin, and report execution; secrets themselves remain vaulted and are never presented to the agent. Configuration separates secrets into environment variables (e.g., DELINEA_PASSWORD) and non-secrets into config.json, with scope controls (enabled_tools, allowed object types), TLS certs, and an optional registration pre-shared key.

Explain me why exactly it matters to me

Enterprises are rapidly wiring agents to operational systems through MCP. Recent incidents—such as a rogue MCP package exfiltrating email—underscore the need for registration controls, TLS, least-privilege tool surfaces, and traceable identity context on every call. Delinea’s server claims to implement these controls in a PAM-aligned pattern (ephemeral auth + policy checks + audit), reducing credential sprawl and simplifying revocation.

Summary

Delinea’s MIT-licensed MCP server gives enterprises a standard, auditable way for AI-agent credential access—short-lived tokens, policy evaluation, and constrained tools—to reduce secret exposure while integrating with Secret Server and the Delinea Platform. It’s available now on GitHub, with initial coverage and technical details confirming OAuth2, STDIO/HTTP(SSE) transports, and scoped operations.

Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.

Source link