Akeyless Connector for Mistral AI

An SDK-based MCP connector that brings Akeyless Agentic Runtime Authority (ARA) and secure secret fetching to Mistral AI — without installing the Akeyless CLI.

Mistral orchestrates. Akeyless holds the credentials. ARA tools never expose secret values to the model.

Features

| Capability | Tools | |---|---| | ARA (secretless) | list-secrets, query-db, service-execute, list-sub-tools | | Secure secret fetch | list-items, get-secret-value (RBAC, masking, JSON field extraction) | | Transports | stdio (local) and Streamable HTTP (Mistral Connectors) |

Install

Published on npm as @akeyless-community/mistral-connector:

npm install -g @akeyless-community/mistral-connector

Or use npx without a global install.

Quick start

Option A — Mistral Studio Connectors (recommended)

Mistral Connectors require a public HTTPS MCP endpoint. Deploy the HTTP transport behind TLS (reverse proxy, load balancer, or cloud runtime), then register it in Studio.

1. Start the HTTP server (behind your TLS terminator):

export AKEYLESS_GATEWAY_URL=https://your-gateway.example.com:8000/api/v2
export AKEYLESS_ACCESS_ID=p-xxxxx
export AKEYLESS_ACCESS_KEY=your-access-key
export AKEYLESS_AGENT_ID=mistral
export AKEYLESS_MCP_TRANSPORT=http
export AKEYLESS_MCP_HTTP_API_KEY=your-mcp-api-key   # recommended
npx -y @akeyless-community/mistral-connector --http

2. Register in Mistral Studio → Connectors → Custom MCP Connector:

| Field | Value | |---|---| | Connector name | akeyless-ara | | Server URL | https://your-public-host.example.com/mcp | | Auth | Bearer token matching AKEYLESS_MCP_HTTP_API_KEY |

Or register via API:

export MISTRAL_API_KEY=your-mistral-api-key
export MISTRAL_CONNECTOR_SERVER_URL=https://your-public-host.example.com/mcp
python3 scripts/register-mistral-connector.py

3. Attach the connector to a conversation or agent and ask in natural language:

"List my Akeyless ARA secrets and run SELECT count(*) FROM users against /prod/db/postgres-readonly."

Option B — Local stdio (development)

export AKEYLESS_GATEWAY_URL=https://your-gateway.example.com:8000/api/v2
export AKEYLESS_ACCESS_ID=p-xxxxx
export AKEYLESS_ACCESS_KEY=your-access-key
npx -y @akeyless-community/mistral-connector

Use with any MCP client that supports stdio transport.

Architecture

sequenceDiagram
    participant User as User
    participant Mistral as Mistral Agent
    participant MCP as akeyless-mistral-mcp
    participant API as Akeyless API
    participant GW as Akeyless Gateway
    participant Target as Database / Cloud

    User->>Mistral: "Query prod postgres for user count"
    Mistral->>MCP: list-secrets
    MCP->>API: list-items via gw:8000/api/v2
    API-->>MCP: secret paths + target types
    MCP-->>Mistral: /prod/db/postgres-ro
    Mistral->>MCP: query-db
    MCP->>GW: POST gw:8000/config/target_query
    GW->>Target: execute with JIT credentials
    Target-->>GW: query results
    GW-->>MCP: JSON results (no credentials)
    MCP-->>Mistral: { count: 42 }

MCP tools

ARA tools (secretless — preferred)

| Tool | Purpose | |---|---| | list-secrets | List ARA-enabled dynamic, rotated, and custom-MCP secrets | | query-db | Run database queries (MySQL, PostgreSQL, MongoDB, Redis, etc.) | | service-execute | Run AWS, GCP, Azure, Kubernetes, GitHub, or custom MCP actions | | list-sub-tools | Optional: discover service sub-tool names/parameters |

Secure secret tools

| Tool | Purpose | |---|---| | list-items | List static, dynamic, and rotated secrets — metadata only | | get-secret-value | Fetch a secret value with RBAC, optional masking, and JSON field extraction |

get-secret-value supports:

• secret-type: static (default), dynamic, or rotated
• json-key: extract one field from a JSON secret (e.g. OPENAI_API_KEY)
• mask=true: return a masked preview instead of the full value
• ignore-cache=true: bypass Gateway cache

Set AKEYLESS_DISABLE_SECRET_VALUE_TOOLS=true for ARA-only mode.

Environment variables

| Variable | When to set | |---|---| | AKEYLESS_GATEWAY_URL | Always — e.g. https://gw.example.com:8000/api/v2 | | AKEYLESS_ACCESS_TYPE | access_key (default), saml, oidc, universal_identity, jwt, aws_iam, azure_ad, gcp | | AKEYLESS_ACCESS_ID | access_key, saml, oidc, jwt, cloud IAM | | AKEYLESS_ACCESS_KEY | access_key only | | AKEYLESS_AGENT_ID | Recommended (default mistral) | | AKEYLESS_MCP_TRANSPORT | Set to http for Mistral Connectors | | AKEYLESS_MCP_HTTP_HOST | HTTP bind host (default 0.0.0.0) | | AKEYLESS_MCP_HTTP_PORT | HTTP port (default 8787) | | AKEYLESS_MCP_HTTP_PATH | MCP endpoint path (default /mcp) | | AKEYLESS_MCP_HTTP_API_KEY | Bearer token for HTTP auth (recommended in production) | | AKEYLESS_DISABLE_SECRET_VALUE_TOOLS | Set true to disable get-secret-value |

See .env.example for all auth options.

Prerequisites

• Akeyless Gateway with Agentic Runtime Authority enabled
• A role with ARA Allow Access on relevant secret paths (for ARA tools)
• Read permission on secret paths (for get-secret-value)
• Node.js >= 18
• For Mistral Connectors: public HTTPS endpoint with valid TLS certificate

Security model

• ARA is secretless — credentials are resolved and used by the Gateway; only query/action results are returned
• RBAC-scoped — Akeyless enforces role permissions on every API call
• Masked previews — get-secret-value supports mask=true for verification without full exposure
• JSON field extraction — json_key avoids returning entire JSON blobs
• HTTP API key — protect the public MCP endpoint with AKEYLESS_MCP_HTTP_API_KEY
• Audited — ARA executions are recorded with agent ID + MCP ID

Recommendations:

• Prefer ARA tools over get-secret-value whenever possible
• Scope roles to least-privilege secret paths
• Use mask=true unless the full value is explicitly required
• Set meaningful Agent IDs per user or workload (e.g. mistral-alice-workflow)

Example prompts

"List my Akeyless ARA secrets."

"Run SELECT count(*) FROM customers against /prod/db/postgres-readonly."

"Use service-execute on /prod/aws/devops to list all S3 buckets."

"Verify I can read /prod/api/openai-key with masking enabled."

Development

cd mistral-akeyless-connector
npm install
npm run build
npm test

Run locally:

# stdio
npm start

# HTTP
npm run start:http

Health check (HTTP mode): GET /health

Related projects

• cursor-akeyless-connector — SDK-based MCP for Cursor
• claude-akeyless-connector — SDK-based MCP for Claude Desktop
• codex-akeyless-integration — SDK-based MCP for OpenAI Codex
• devin-akeyless-connector — SDK-based MCP for Devin / Windsurf

License

MIT — see LICENSE.