Agent Vault is unclaimed —

Agent Vault

A credential broker for AI agents to prevent credential exfiltration.·docs.agent-vault.dev

Free plan · Open source See pricing ↓

Agent Vault is an open source credential broker and proxy service, built by Infisical, that sits between AI agents and the APIs they call, including LLM providers, GitHub, and Stripe. It swaps dummy credentials held by an agent for real credentials on outbound requests so agents never hold or see real secrets, protecting against credential exfiltration via prompt injection. It is self-hosted via a binary or Docker, with vaults, service definitions, agent tokens, and a proposal/approval workflow for managing credential access across teams.

What it's for

secure remote coding agentsall-purpose agentscustom agents and harnessessecure ephemeral sandboxes

Features 17

Agents use dummy placeholder credentials that Agent Vault substitutes server-side
Argon2id password and master-key hashing
CLI for managing accounts, sessions, master password, and settings
DNS rebinding protection via resolved-IP validation
Email domain restriction for signups and vault invites
Encryption at rest using AES-256-GCM
HTTPS_PROXY/HTTP_PROXY-based transparent MITM proxy for routing agent traffic
Instance roles (owner, member, no-access) and vault roles (admin, member, proxy) for access control
KEK/DEK key-wrapping architecture with optional master password
Network guard blocking RFC-1918, loopback, link-local, CGN, and cloud metadata IP ranges
Proposal system for reviewing and approving agent-initiated credential/service changes
Proxies AI agent traffic and injects real credentials into outbound requests
Resource caps on pending proposals, invites, sessions, and proposal rules
Self-hosting support via Docker, Fly.io, Linux/macOS install script, and PostgreSQL for multi-instance deployments
Support for external credential stores such as Infisical
Tiered rate limiting (AUTH, AUTHED, PROXY, GLOBAL) with configurable profiles
Token model with user sessions, scoped sessions, agent tokens, approval tokens, and vault invites

At a glance

free tieropen sourceself-hostableAPI

DeploymentSelf-hosted

PlatformsWeb, Linux, macOS

CompanyInfisical

Integrations

GitHubSlackClaude CodeOpenCodeAWS ECSStripeCodexHermes AgentInfisicalOpenClawPostgreSQLKubernetesFly.ioDockerCursor

Pricing

The core self-hosted software has no listed price. Infisical also offers a managed enterprise version of Agent Vault with enterprise support, SLAs, and advanced features, available by booking a demo; pricing for that offering is not publicly listed.