# Agent Vault

> A credential proxy so agents can use API keys without ever holding them

- Category: Evaluation & Production Ops / Guardrails & Security
- Language: Go
- Licence: MIT (ee/ directories under a separate enterprise licence)
- Repository: https://github.com/Infisical/agent-vault
- Website: https://docs.agent-vault.dev
- Canonical page: https://ai-tldr.dev/tools/agent-vault/
- Updated: 2026-04-22

## In short

Agent Vault is an open-source credential broker from Infisical that sits between your AI agents and the APIs they call. It sits in the Guardrails & Security category of the Evaluation & Production Ops tools and is open-source, written in Go and licensed MIT (ee/ directories under a separate enterprise licence).

## Overview

Agent Vault is an open-source credential broker from Infisical that sits between your AI agents and the APIs they call. Its premise is that agents should not possess credentials at all: an agent that holds an `ANTHROPIC_API_KEY` or a `GITHUB_PAT` can be talked into leaking it through prompt injection, so Agent Vault removes the secret from the agent's reach entirely. Credentials live in the vault, agents route outbound HTTP through it, and it attaches the real credential to each request before forwarding it upstream.

It ships as a single binary that is both server and CLI client, using a MITM proxy architecture — the management UI and API on port 14321, the transparent HTTP/HTTPS proxy on port 14322. Agents are bootstrapped with `HTTPS_PROXY` pointing at that listener, which keeps the integration non-invasive: existing MCP servers, CLIs, SDKs and plain API calls all flow through it unchanged. By design the vault is meant to run on a separate machine from the agents, which is what makes the guarantee real. A service rule can substitute a dummy placeholder such as `__anthropic_api_key__` with the real key, or replace the auth header outright.

Beyond brokering, Agent Vault filters egress — because authenticated traffic passes through it, you control which agents may reach which services and endpoints, and a vault can be flipped to strict deny mode (`unmatched_host_policy=deny`) so unmatched hosts get a 403 instead of plain proxy passthrough. Request logging lets you inspect authenticated traffic to diagnose agent behaviour. Credential stores are pluggable: the local encrypted store, or an external secrets backend such as Infisical for dynamic secrets. Infisical positions Agent Vault as the simpler self-contained option and its commercial Agent Proxy as the production-grade one; the repository is MIT-licensed apart from any `ee/` directories, which carry a separate enterprise licence.

## What it does

- Credential brokering: agents call LLM providers, GitHub, Stripe and other APIs without ever holding a real key
- Transparent integration through `HTTPS_PROXY` — MCP servers, CLIs, SDKs and raw API calls work unmodified
- Egress filtering that controls which agents may reach which services and endpoints, with an optional strict deny mode
- Request logging over authenticated traffic for monitoring and diagnosing what an agent actually did
- Pluggable credential stores — a local encrypted store, or an external backend such as Infisical for dynamic secrets
- Single binary acting as server and CLI, with a management UI, multi-tenancy and per-agent tokens for ephemeral sandboxes

## Getting started

Agent Vault is installed as one binary on macOS (Intel and Apple Silicon) or Linux (x86_64 and ARM64), or run from the published Docker image. Deploy it on a different machine from your agents.

1. Install the binary

   The install script from the project's domain covers both supported platforms.

```bash
curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh
```

2. Start the server with a master password

   The master password feeds the data encryption mechanism and is unset from the process after the initial read — store it somewhere safe.

```bash
export AGENT_VAULT_MASTER_PASSWORD=your-password
agent-vault server -d
```

3. Or deploy it with Docker

   Publish both ports: 14321 for the API and management UI, 14322 for the proxy.

```bash
docker run -it -p 14321:14321 -p 14322:14322 \
  -e AGENT_VAULT_MASTER_PASSWORD=your-password \
  -v agent-vault-data:/data infisical/agent-vault
```

4. Create a vault, then point an agent at the proxy

   Open http://<host>:14321 to create the owner account, add credentials such as ANTHROPIC_API_KEY, and write a service rule that substitutes a dummy value like __anthropic_api_key__ with the real key. Then create an agent, take its token, and run the agent with its traffic proxied through the vault.

```bash
HTTPS_PROXY=http://agent-vault:14322
```

## When to use it

- Run a remote Claude Code or other coding agent that can call the Anthropic and GitHub APIs without the session ever seeing those keys
- Structurally block credential exfiltration through prompt injection, instead of trying to detect it in the prompt
- Restrict which services an all-purpose agent such as OpenClaw or Hermes may reach, and deny everything else
- Mint a short-lived token for an ephemeral sandboxed agent so an orchestrator can grant scoped API access per run

## Version history

- 2026-04-22: AI/TLDR covered Agent Vault's launch: Infisical's open-source HTTP proxy injects credentials at the network layer, so agents such as Claude Code, Cursor and Codex never see the real keys.