Apps

Vault ships a single Go binary that exposes several distinct runtimes, each selected by the first CLI argument. They share most of the code under vault/, sdk/, and helper/, but their entry points and lifecycles differ enough to warrant separate pages.

App	Subcommand	Source	Purpose
Server	vault server	command/server.go	The main long-running Vault process. Listens on HTTP, owns the storage barrier, hosts every backend.
CLI	vault <command>	command/commands.go, command/<verb>_<noun>.go	A short-lived command-line client over the API.
Agent	vault agent	command/agent.go, command/agent/	Long-running client-side daemon: auto-auth, secret templating, a pass-through cache.
Proxy	vault proxy	command/proxy.go, command/proxy/	Newer, slimmer relative of the agent: a request-forwarding proxy with caching.

All four are registered in command/commands.go's initCommands map. The shared base is command/base.go (23k lines) plus command/base_flags.go, command/base_helpers.go, and command/base_predict.go (predicate-completion helpers).

The CLI talks to the server through the public Go client at api/ — see api package. The server talks to its plugins through sdk/plugin/ — see sdk package.

Per-app pages

• Server — the vault server daemon, configuration, listener, storage, plugin wiring.
• CLI — every vault <verb> and vault <verb> <noun> subcommand and how they're registered.
• Agent — auto-auth, templating, caching for application clients.
• Proxy — the new lightweight forwarding proxy.