MCP vs. Raw APIs: What the Protocol Actually Does

▶ Watch (01:33)

Anthropic released MCP in November 2024 as a protocol built from scratch for large language models. A conventional API was designed for software-to-software communication; MCP standardizes how models fetch context and call tools. The three primitives are tools (write operations), resources (read operations), and prompts (workflow recipes).

The practical gain is context freshness. An LLM trained on a six-month snapshot has no knowledge of a provider published last week. The MCP server fetches exact documentation for a pinned provider version at query time, so the model works from current data.

Terraform MCP: Registry Lookups and Policy Recommendations

▶ Watch (05:03)

The Terraform MCP server, released in May, was built around registry.terraform.io. Ask it to configure a GCP storage bucket and it fans out across interconnected documentation pages, then combines them into working Terraform code. In the GCP storage bucket and Sentinel policy demo (08:59), the agent retried the policy search several times before locating a CIS-inspired Sentinel policy for GCP, adapting it, and writing it into the configuration alongside HashiCorp’s standard file and folder layout.

Private Modules, HCP Terraform, and End-to-End Validation

▶ Watch (11:54)

Two days before HashiConf, HashiCorp released HCP Terraform support in the Terraform MCP server. The new feature lets teams search private module registries before falling back to the public one. Baghel defined an agent.md instruction file that told the agent to attach a cloud backend to every configuration and check the private registry first. In the AKS private-module terraform plan demo (15:00), the agent pulled an AKS module from the private HCP Terraform registry, pinned the correct provider version from the module’s metadata, ran terraform init, validate, and plan inside HCP Terraform, and the plan passed on the first attempt.

Vault MCP: Migrating Hardcoded Credentials at Prompt Time

▶ Watch (18:16)

The Vault MCP server, now publicly available on DockerHub, supports reading, writing, and deleting secrets, issuing PKI certificates, and mounting new secret engines. In the Node.js app Vault secrets migration demo (20:20), the agent scaffolded a Node.js app that uploaded files to S3 using environment variables for AWS credentials. On the next prompt, it checked whether the required Vault mount existed, created it, stored the credentials under separate paths for the bucket name and the access keys, and rewrote the application code to fetch secrets from Vault instead of environment variables.

Vault Radar MCP: Turning Secret Sprawl into a Priority List

▶ Watch (23:27)

Vault Radar is HashiCorp’s secret scanning tool. Its MCP server, available on DockerHub, handles natural-language queries against data ingested from GitHub, AWS, Azure, and other sources. In the Radar triage: 800 repos, 10% monitored (25:07), the agent determined that the organization had 800 GitHub resources across 10 data sources, then filtered for actively monitored repositories and found only 10% qualified. A final query returned the top-10 critical findings.

“it’s super insecure” — Gautam Baghel

Notable Quotes

you can create like Lego masterpieces Gautam Baghel · ▶ 13:39

it’s super insecure Gautam Baghel · ▶ 26:41

accuracy. You have the proper schema. Gautam Baghel · ▶ 17:42

Key Takeaways

  • MCP servers give LLMs live registry context, cutting hallucinations on provider docs and module versions.
  • An agent.md instruction file forces the agent to check private modules before public ones.
  • Vault Radar MCP converts sprawling multi-source secret alerts into a prioritized fix list in seconds.