Infisical/agent-vault

Agent Vault – Secure credential proxy for AI agents

What it is – Agent Vault is an open‑source service that sits between your AI agents (e.g. Claude, GPT‑based bots, custom agents) and the external APIs they need to call. It stores secrets (API keys, tokens, etc.) and injects them into outbound HTTP requests on‑the‑fly, so the agents never see the real credentials.

Why it matters – Large‑language‑model agents can be tricked by prompt‑injection attacks into leaking any secret they have in their environment. By removing credentials from the agent’s process and handing them to a trusted proxy, the risk of credential exfiltration is dramatically reduced.

---

Core components

Component	Role
Server binary (agent-vault)	Runs a management API (default port 14321) and a transparent HTTP/HTTPS MITM proxy (default port 14322). Stores secrets encrypted with a master password (SQLite by default, optional PostgreSQL).
CLI	Provides commands to start the server, create vaults, credentials, agents, and to run an agent process through the proxy (agent-vault run -- <command>).
Web UI	Simple UI for creating vaults, adding credentials, defining service rules, and issuing agent tokens.
Pluggable credential stores	Can back the vault with an external secrets manager such as Infisical, enabling dynamic secrets and other advanced features.
TypeScript SDK	Allows an orchestrator to programmatically mint short‑lived tokens and generate the environment variables a sandboxed agent needs to proxy through Agent Vault.

---

How it works (high‑level flow)

1. Deploy the server on a machine separate from your agents (Docker, binary, or compiled Go). Set a master password; the server encrypts its SQLite/Postgres database with it.
2. Create a vault inside the server and add credentials (e.g. ANTHROPIC_API_KEY).
3. Define service rules that map placeholder values (e.g. __anthropic_api_key__) or header names to the real secret.
4. Create an agent record and obtain a token that authorises that agent to use a specific vault.
5. In the agent’s runtime, set:

   AGENT_VAULT_ADDR=http://<host>:14321
   AGENT_VAULT_TOKEN=<agent‑token>
   AGENT_VAULT_VAULT=<vault‑name>
   ANTHROPIC_API_KEY=__anthropic_api_key__   # dummy placeholder
   HTTPS_PROXY=http://<host>:14322
   

6. Run the agent via the CLI (agent-vault run -- <your‑agent‑command>). The CLI starts the proxy, injects the master CA cert, and forwards all outbound HTTPS traffic through the proxy.
7. When the agent makes a request to api.anthropic.com, the proxy replaces the placeholder with the real key (or adds the appropriate Authorization header) before forwarding the request.
8. All traffic can be logged, filtered, or denied based on the configured service rules.

---

Key features

• Credential brokering – Real secrets never leave the vault; the proxy swaps dummy placeholders with the actual values at request time.
• Pluggable secret back‑ends – Use the built‑in encrypted store or connect to Infisical for dynamic secrets.
• Transparent integration – Works with any tool that respects HTTPS_PROXY/HTTP_PROXY (CLI tools, SDKs, Docker, etc.) – no code changes required.
• Multi‑tenancy & per‑agent tokens – Separate agents get isolated access; tokens can be short‑lived for sandboxed workloads.
• Egress filtering & strict‑deny mode – Define which hostnames/services an agent may contact; unmatched requests can be blocked with 403.
• Request logging & audit – Inspect injected requests to debug or monitor agent behavior.
• Deployable as a single binary or Docker image – Simple installation script (curl … | sh) works on macOS, Linux, ARM, and x86.
• Optional PostgreSQL backend – Enables scaling across multiple replicas.
• TypeScript SDK – Programmatic token minting and environment generation for container‑based sandboxes.

---

Typical use cases

Scenario	What Agent Vault provides
Remote coding agents (e.g., Claude Code)	Store ANTHROPIC_API_KEY and GITHUB_PAT once; the agent can push commits or open PRs without ever seeing the keys.
All‑purpose agents (OpenClaw, Hermes, etc.)	Centralised secret management; each agent gets a token scoped to the services it may call.
Custom agents / harnesses	Developers can add a single HTTPS_PROXY line and placeholder env vars; the proxy handles credential injection.
Ephemeral sandboxes	Orchestrator mints a short‑lived token via the SDK, mounts the CA cert, and hands the sandbox a ready‑to‑use proxy config.
Enterprise deployments	Use PostgreSQL, SSO‑protected UI, IP allow‑lists, and the commercial “Infisical Agent Vault” for additional access‑control features.

---

Getting started (quick‑start)

# Install the binary (macOS/Linux, Intel/ARM)
curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh

# Export a master password (keep it safe)
export AGENT_VAULT_MASTER_PASSWORD=super‑secret

# Start the server (creates SQLite DB in ./data)
agent-vault server -d

• Open http://localhost:14321 in a browser, create the first owner user, then add a vault, credentials, and a service rule.
• Create an agent token via the UI or CLI (agent-vault agent create …).
• In the agent’s container or VM, install the CLI the same way and run:

export AGENT_VAULT_ADDR=http://<host>:14321
export AGENT_VAULT_TOKEN=<token>
export AGENT_VAULT_VAULT=my‑vault
export ANTHROPIC_API_KEY=__anthropic_api_key__
agent-vault run -- python my_agent.py

The agent now talks to external APIs without ever seeing the real key.

---

Development & contribution

• Built with Go (backend) and Vite/React (frontend UI).
• Common commands:
  • make build – compile Go binary and frontend assets.
  • make test – run unit tests.
  • make dev – run backend and frontend dev servers with hot‑reload.
  • make docker – produce the infisical/agent-vault Docker image.
• The repository is MIT‑licensed; an ee/ folder contains optional enterprise features that require a commercial Infisical license.

---

License

MIT Expat license (see the repository’s LICENSE file). The core is fully open source; premium extensions are gated behind a commercial license.

---

TL;DR

Agent Vault lets you keep API keys, tokens, and other secrets out of your AI agents by acting as a secure, MITM‑style HTTP proxy that injects the right credentials at request time. It’s a single binary (or Docker image), supports pluggable secret stores, per‑agent tokens, and works with any tool that respects standard proxy environment variables—making credential‑safe AI agent deployments straightforward.