Plugin Components

Each Vault plugin is built from one or more components: skills, commands, and MCP servers.

Skills

A skill teaches Claude a specific task. When you install a skill, Claude matches your messages to the skill's trigger phrases, a list of intent descriptions in the skill's description. When Claude sees a match, it follows the skill's steps to assist you.

Skills can also be invoked explicitly with a slash command:

/vault:query
/vault-administrator:mdl
/vault-developer:java-sdk

The format is /plugin-name:skill-name. You can use explicit invocation when you want to force a specific skill rather than relying on Claude's intent matching.

Skill Naming

Skill names reflect user intent, not the underlying technology. For example:

Skill name	What it's for	Not named
`query`	Retrieve data from Vault	`vql`
`mdl`	Create, modify, and debug Vault configuration components	`configuration`
`java-sdk`	Write Vault Java SDK entry-point classes	`trigger` or `action`

The name completes the sentence "I want to ___" from your perspective as the user.

Skill Boundaries

Skills generate artifacts: queries, MDL statements, Vault Java SDK classes, load files. Every Vault plugin skill enforces this boundary:

Reads run anywhere, after you have named the target Vault.
Writes run only against a Vault that login has classified as non-production, after your explicit confirmation.
Against a production or unknown Vault, the skill gives you the exact command rather than running it.

On a sandbox, skills run CLI commands directly and report the result. On production, the skill gives you the exact command to run yourself.

MCP Servers

An MCP server is a remote server that gives Claude access to live tools: APIs, databases, or the local file system. Each Vault plugin registers one MCP server:

Vault Documentation MCP: Answers questions about Vault's API, VQL, SDK, and Help documentation from official published references. Skills use this MCP server to look up endpoint paths, field API names, and syntax rules rather than guessing.

The Vault CLI runs as a command, not as an MCP server. When a skill needs the CLI, it issues the command and reads the output.

How Components Fit Together

A single user request may involve multiple components working in sequence:

You type a message.
Claude matches it to a skill's trigger phrases or you can invoke a skill explicitly.
The skill's steps run, using the Vault Documentation MCP to look up syntax and the Vault CLI to act on a connected Vault.
If another skill owns a sub-task, for example, authentication before a query, the skill hands off to that skill rather than handling it itself.
Claude presents the result and offers a next step.