Agent Vault

Agent Vault is an open source credential broker from Infisical that keeps secrets out of the hands of AI agents. It runs as a vault and proxy between an agent and the APIs it calls, such as model providers, GitHub and Stripe. The agent routes its HTTP traffic through the Agent Vault server holding only dummy credentials, and the server swaps in the real ones, or replaces auth headers entirely, before forwarding each request. It is built for teams running agents such as Claude Code, OpenClaw or Hermes, custom agents and harnesses, remote coding agents and ephemeral sandboxes, where a prompt injection could otherwise trick an agent into exfiltrating keys. Traditional secrets managers return credentials to the application, which the project argues is unsafe for agents; Agent Vault never exposes them to the agent process. An operator installs the binary or deploys it with Docker on a separate host, configures credentials and substitution rules, and points the agent at the proxy through a standard proxy environment variable. A management UI and API run on their own port, and the documentation advises keeping operator access private or fronting it with TLS and authentication through an SSO reverse proxy, IP allowlist or VPN. The open source edition is free to self host, and the documentation lists no pricing. Infisical Agent Vault, which brings credential brokering into the commercial Infisical platform with enterprise support and SLAs, is sold through a demo booking, so its pricing is quote based.