Agent Vault

// Overview

Agent Vault is an open-source credential broker from Infisical that sits between your AI agents and the APIs they call. Its premise is that agents should not possess credentials at all: an agent that holds an `ANTHROPIC_API_KEY` or a `GITHUB_PAT` can be talked into leaking it through prompt injection, so Agent Vault removes the secret from the agent's reach entirely. Credentials live in the vault, agents route outbound HTTP through it, and it attaches the real credential to each request before forwarding it upstream.

It ships as a single binary that is both server and CLI client, using a MITM proxy architecture — the management UI and API on port 14321, the transparent HTTP/HTTPS proxy on port 14322. Agents are bootstrapped with `HTTPS_PROXY` pointing at that listener, which keeps the integration non-invasive: existing MCP servers, CLIs, SDKs and plain API calls all flow through it unchanged. By design the vault is meant to run on a separate machine from the agents, which is what makes the guarantee real. A service rule can substitute a dummy placeholder such as `__anthropic_api_key__` with the real key, or replace the auth header outright.

Beyond brokering, Agent Vault filters egress — because authenticated traffic passes through it, you control which agents may reach which services and endpoints, and a vault can be flipped to strict deny mode (`unmatched_host_policy=deny`) so unmatched hosts get a 403 instead of plain proxy passthrough. Request logging lets you inspect authenticated traffic to diagnose agent behaviour. Credential stores are pluggable: the local encrypted store, or an external secrets backend such as Infisical for dynamic secrets. Infisical positions Agent Vault as the simpler self-contained option and its commercial Agent Proxy as the production-grade one; the repository is MIT-licensed apart from any `ee/` directories, which carry a separate enterprise licence.

// What it does

• Credential brokering: agents call LLM providers, GitHub, Stripe and other APIs without ever holding a real key
• Transparent integration through `HTTPS_PROXY` — MCP servers, CLIs, SDKs and raw API calls work unmodified
• Egress filtering that controls which agents may reach which services and endpoints, with an optional strict deny mode
• Request logging over authenticated traffic for monitoring and diagnosing what an agent actually did
• Pluggable credential stores — a local encrypted store, or an external backend such as Infisical for dynamic secrets
• Single binary acting as server and CLI, with a management UI, multi-tenancy and per-agent tokens for ephemeral sandboxes

// Getting started

Agent Vault is installed as one binary on macOS (Intel and Apple Silicon) or Linux (x86_64 and ARM64), or run from the published Docker image. Deploy it on a different machine from your agents.

curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh

export AGENT_VAULT_MASTER_PASSWORD=your-password
agent-vault server -d

docker run -it -p 14321:14321 -p 14322:14322 \
  -e AGENT_VAULT_MASTER_PASSWORD=your-password \
  -v agent-vault-data:/data infisical/agent-vault

HTTPS_PROXY=http://agent-vault:14322

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Run a remote Claude Code or other coding agent that can call the Anthropic and GitHub APIs without the session ever seeing those keys
• Structurally block credential exfiltration through prompt injection, instead of trying to detect it in the prompt
• Restrict which services an all-purpose agent such as OpenClaw or Hermes may reach, and deny everything else
• Mint a short-lived token for an ephemeral sandboxed agent so an orchestrator can grant scoped API access per run

// How Agent Vault compares

Agent Vault alongside other open-source guardrails & security tools AI/TLDR tracks, ranked by GitHub stars.