Agent Vault is live · free plan; paid plans on request · last verified 25 Oct 2026 · viability healthy
Agent Vault
Open-source credential broker and MITM proxy that keeps real API keys out of AI agents by substituting dummy tokens in transit.
If your agents run with live API keys in their environment, Agent Vault closes the most obviously exploitable path in that setup: the agent holds placeholders, the proxy holds the secret, and prompt injection has nothing worth exfiltrating. The tradeoff is operational — you run the proxy yourself, a host with no matching service rule isn't brokered, and remote admin on port 14321 is your problem (TLS plus SSO reverse proxy, IP allowlist, or VPN). Worth it the moment an agent touches production APIs; overkill for a toy project or a team that can't maintain a dedicated proxy host.
Verdict generatedVerified 5d ago · liveness 75/100 · cite: rightaichoice.com/tools/agent-vault
- Security engineers running remote coding agents that currently hold real API keys
- Platform teams building custom agent harnesses or sandboxes that need credential brokering
- Operators offering ephemeral sandboxed agents to untrusted users
- DevOps and SREs comfortable self-hosting a proxy on a dedicated host
- Non-technical users who can't self-host and maintain a proxy service
- Workflows where the agent must legitimately read or handle the real secret itself
- Small projects where the extra proxy hop isn't justified by the security need
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Agent Vault if you can't run and maintain a dedicated proxy host on the agent's network path, since the vault becomes a hard dependency for every authenticated API call your agent makes.
The proxy hop itself is the hidden cost: every agent API call now depends on Agent Vault being up, so you're effectively funding a highly-available host and its monitoring.
The open-source edition is free to self-host, which puts it in a different budget conversation from paid self-managed secret stores like HashiCorp Vault and Doppler — you trade licence spend for the operational cost of running a proxy host. Infisical's managed enterprise edition is the supported path for teams that don't want that operational load.
In short
Agent Vault — Open-source credential broker and MITM proxy that keeps real API keys out of AI agents by substituting dummy tokens in transit. Best for Security engineers running remote coding agents that currently hold real API keys, Platform teams building custom agent harnesses or sandboxes that need credential brokering, Operators offering ephemeral sandboxed agents to untrusted users. Free to start; it also has paid plans whose price we could not confirm — see the pricing table.
What is Agent Vault?
Agent Vault — Open-source credential broker and MITM proxy that keeps real API keys out of AI agents by substituting dummy tokens in transit. Best for Security engineers running remote coding agents that currently hold real API keys, Platform teams building custom agent harnesses or sandboxes that need credential brokering, Operators offering ephemeral sandboxed agents to untrusted users. Free to start; it also has paid plans whose price we could not confirm — see the pricing table.
Agent Vault is an open-source vault and proxy service from Infisical that sits between AI agents and the APIs they call, including LLM providers, GitHub, and Stripe. You install the Agent Vault binary or deploy it with Docker on a separate host, define service rules that map a target host to a real credential, and register each agent to get a token. The agent's environment is then bootstrapped via the Agent Vault CLI with AGENT_VAULT_ADDR, AGENT_VAULT_TOKEN, and AGENT_VAULT_VAULT, and all outbound HTTP and HTTPS traffic is routed through the proxy at port 14322 while the management UI and API listen on port 14321. The agent is given dummy credentials such as __anthropic_api_key__ or __github_pat__; when it calls api.anthropic.com or api.github.com, Agent Vault matches the host against the service rules, substitutes the real secret or replaces the auth header entirely, and forwards the reconstructed request upstream. The real secret never enters the agent's process. The design assumption is blunt: agents are exploitable via prompt injection, so handing a credential back to the workload is the wrong model. Because the agent only holds placeholder strings, an injection payload has nothing to steal. Dedicated connection guides cover Claude Code, Cursor, Codex, OpenClaw, Hermes Agent, OpenCode, and custom HTTP-capable agents. It is built for security engineers, platform teams, and DevOps or SREs who run remote coding agents or sandboxes that currently hold live credentials. Infisical also offers an enterprise-grade managed version of credential brokering inside the Infisical platform.
Key features
- Credential broker that substitutes dummy credentials like __anthropic_api_key__ with real secrets
- MITM proxy intercepts outbound HTTP and HTTPS traffic from agents on port 14322
- Self-hosted deployment via binary or Docker on a separate host
- Management UI and API served on port 14321
- Bootstrap agent environment with AGENT_VAULT_ADDR, AGENT_VAULT_TOKEN, and AGENT_VAULT_VAULT
- HTTPS_PROXY=agent-vault:14322 routing for all agent HTTP traffic
- Service rules match the target host and inject the correct credential
- Replaces auth headers entirely when reconstructing upstream requests
- Mint short-lived tokens from an orchestrator agent construct for ephemeral sandboxes
- Works with any HTTP-capable agent via API, CLI, SDK, or MCP
- Connection guides for Claude Code, Cursor, Codex, OpenClaw, Hermes Agent, and OpenCode
- Brokers credentials for LLM providers, GitHub, Stripe, and other HTTP services
- Multiple credential stores including Infisical and plaintext
- Open source, with the full documentation index published at /llms.txt
Behind the verdict
Agent Vault makes one argument and makes it well: traditional secrets management returns the credential to the workload, which is exactly the wrong shape for a process that untrusted input can steer. The substitution model is the strength. Your Claude Code or OpenClaw session gets __anthropic_api_key__ and nothing else; Agent Vault matches the outbound host against your service rules, swaps in the real value or replaces the auth header wholesale, and forwards the request. The hosted docs are unusually concrete for a young project — separate quickstarts for Claude Code, Cursor, Codex, OpenClaw, Hermes Agent, OpenCode, and a custom-agent path for anything else that speaks HTTP, plus an /llms.txt index so an agent can read the docs itself. The orchestrator construct is the most interesting piece: if a backend spins up ephemeral sandboxes, you represent the orchestrator as an agent, mint a short-lived token, and pass it into each sandbox rather than embedding a long-lived secret in the image. That is the pattern multi-tenant agent platforms actually need. Where it gets harder is operations. This is self-hosted, and the proxy becomes part of the critical path for every API call an agent makes — if it is unavailable, the agent cannot authenticate upstream. Coverage is only as good as the service rules you author; a host you never wrote a rule for passes through unbrokered. The documentation is explicit that you must keep the management UI and API on port 14321 private, or front it with TLS plus authentication — an SSO reverse proxy, an IP allowlist, or a VPN — if you want remote administration. That is real work the tool does not do for you. It also assumes the agent can function with dummy credentials and never legitimately needs to read the real secret, which rules out workflows where the secret itself is the payload. Compared with self-managed secret stores like HashiCorp Vault and Doppler, Agent Vault is narrower by design — it brokers credentials for agents rather than managing secrets for your whole estate — and Infisical positions a managed, enterprise-supported version for teams that don't want to run the proxy themselves. Choose it when an agent with production API access is a risk you can name; skip it when the agent can't reach anything that matters.
Limitations
- Agent Vault is self-hosted: you run and maintain both the Agent Vault server and the MITM proxy, and if the proxy is unavailable your agents can't authenticate upstream.
- Remote administration is not built in — the docs state you must keep the management UI/API on port 14321 private, or front it with TLS plus authentication (SSO reverse proxy, IP allowlist, or VPN) to expose it safely.
- Because the proxy intercepts all outbound HTTP and HTTPS traffic from the agent, it becomes part of your critical path for every API call the agent makes.
- Coverage depends on you authoring service rules per target host; a host with no matching rule is not brokered.
- The agent must be able to work with dummy credentials and never legitimately need the real one, which rules out workflows where the real secret has to be read.
as of 2026-10-20
Researching Agent Vault? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Is Agent Vault still active?
Agent Vault is live · free plan; paid plans on request · last verified 25 Oct 2026 · viability healthy.
Viability score
How well maintained and how widely used is Agent Vault? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →What do users say about Agent Vault?
What people actually say about Agent Vault — is it worth it?
Our community sentiment research written Jul 30, 2026 is more than 90 days old, so it is being re-reviewed against current data and is not shown.
How we verified this
Every listed fact about Agent Vault— pricing, features, links, status — is re-read from the vendor's own pages by our verification pipeline and each change is logged with a date; the last pass ran on 25 Oct 2026. Pages mix model-assisted synthesis with human review; see how we verify.
Verification history
We have re-verified Agent Vault 8 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — changed who should skip it, switching out, hidden costs, description, switching in, limitations, setup time, pricing fit, our verdict, who it suits, pricing tiers, features, use cases, summary
- — changed features, who it suits, summary, our verdict, who should skip it, description, pricing tiers
- — changed pricing page
- — changed use cases, who it suits, description, our verdict, features, hidden costs, limitations, switching in, switching out, who should skip it, pricing fit, setup time, summary
- — changed SSL certificate
- — changed limitations
Showing the 6 most recent of 8 verification passes.
Free to cite with attribution — this page re-verifies continuously.
How much does Agent Vault cost in 2026?
Agent Vault: Free to start; it also has paid plans whose price we could not confirm — see the pricing table. Pricing last verified 25 Oct 2026.
Plans compared
Every published Agent Vault tier, its price as the vendor publishes it, who it fits, and what it adds over the tier below. The 12-month cost projection follows.
| Plan | Price | Billing | Who it's for |
|---|---|---|---|
| Open Source | Free | — | Security engineers and platform teams who want to self-host credential brokering for agents and can run a proxy host on a private network.Adds: Starting tier: the full self-hosted Agent Vault, MITM proxy, credential substitution rules, Infisical and plaintext credential stores, and per-agent connection guides at no licence cost. |
| Enterprise (managed via Infisical) | Custom | quote | Organisations that want credential brokering delivered inside the Infisical platform with enterprise support and SLAs instead of operating the proxy themselves.Adds: Adds vendor-managed hosting inside the Infisical platform plus enterprise support and SLAs over the open-source self-hosted edition. |
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Where the pricing makes sense
The company stage and team size where Agent Vault's pricing actually pencils out — and where peers do it cheaper.
The open-source edition is free to self-host, which puts it in a different budget conversation from paid self-managed secret stores like HashiCorp Vault and Doppler — you trade licence spend for the operational cost of running a proxy host. Infisical's managed enterprise edition is the supported path for teams that don't want that operational load.
Has Agent Vault's pricing changed?
No plan price for Agent Vault has moved since we began logging in Aug 2026; the pricing page is re-read on every verification pass.
Who should pick Agent Vault?
Pick Agent Vault if you are Security engineers running remote coding agents that currently hold real API keys, Platform teams building custom agent harnesses or sandboxes that need credential brokering, Operators offering ephemeral sandboxed agents to untrusted users, DevOps and SREs comfortable self-hosting a proxy on a dedicated host.
Look elsewhere if you are Non-technical users who can't self-host and maintain a proxy service, Workflows where the agent must legitimately read or handle the real secret itself, Small projects where the extra proxy hop isn't justified by the security need, Teams unwilling to define and maintain service rules for each target host they broker.
Skip it if Skip Agent Vault if you can't run and maintain a dedicated proxy host on the agent's network path, since the vault becomes a hard dependency for every authenticated API call your agent makes.
GeneratedReal-world workflow fit
Concrete scenarios for the personas Agent Vault actually fits — and what changes day-one when you adopt it.
Install Agent Vault on a dedicated host, add the Anthropic credential, write a service rule for api.anthropic.com, register the developer's agent, and bootstrap the environment with AGENT_VAULT_ADDR, AGENT_VAULT_TOKEN, and AGENT_VAULT_VAULT so HTTPS_PROXY points at agent-vault:14322.
Outcome: The agent runs with __anthropic_api_key__ in its environment; a prompt-injection payload has no real key to exfiltrate, and you can rotate the upstream secret without touching developer machines.
Represent the orchestrator as an agent construct, mint a short-lived token, and pass it into each fresh sandbox so the sandboxed agent proxies its GitHub and Stripe calls through Agent Vault using dummy credentials.
Outcome: No long-lived secret is baked into a sandbox image, so a compromised sandbox exposes only a token that expires.
Author service rules for the LLM provider and internal HTTP endpoints the job calls, then set the proxy environment variables in the pipeline so agentic scripts authenticate through Agent Vault.
Outcome: CI logs, env dumps, and job artifacts contain placeholders rather than production tokens, while the operator keeps the real credentials on the vault host.
Use cases
- Secure Claude Code sessions by routing API calls through Agent Vault so the agent never holds the real Anthropic key.
- Deploy ephemeral coding agents in sandboxes where the agent uses dummy credentials the vault substitutes in transit.
- Proxy OpenClaw or Hermes Agent calls to GitHub and Stripe without exposing the underlying tokens to the agent process.
- Run a multi-tenant agent platform where the orchestrator mints a short-lived token per sandbox instead of embedding a long-lived secret.
- Add a credential-brokering layer to CI/CD pipelines that run agentic scripts against production APIs.
- Give a custom HTTP-capable agent authenticated access to LLM providers through the documented custom-agent path.
Setup time & first value
How long it actually takes to get something useful out of Agent Vault — broken out by persona, not the marketing-page minute.
Budget a few hours for a security engineer: install the binary or Docker image on a separate host, add credentials and service rules, register the agent, and bootstrap the environment. The quickstart guides for Claude Code, Cursor, Codex, OpenClaw, Hermes Agent, and OpenCode are per-agent walkthroughs, so each additional agent is a short follow-up rather than a new project.
Switching to or from Agent Vault
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From plaintext API keys in agent env files: replace each real key with a dummy placeholder like __anthropic_api_key__, move the real value into Agent Vault, and write a service rule per target host.
- →From a generic forward proxy: point HTTPS_PROXY at agent-vault:14322 instead, then translate your existing allowlist into Agent Vault service rules with credential substitution.
- →From a self-managed secret store: keep it as the credential store if it's Infisical, otherwise store credentials in Agent Vault and let the proxy do substitution rather than handing secrets to the agent.
- ↗To Infisical's managed enterprise offering: move credential brokering into the Infisical platform when you no longer want to run the proxy host yourself.
- ↗To self-managed HashiCorp Vault or Doppler: keep those as your general secret store and pair them with Agent Vault rather than replacing it.
- ↗To a plain forward proxy: only viable if you accept handing real credentials back to the agent process.
Integrations
Resources & guides
Tutorials & Learning
YouTube returned 6 videos for “Agent Vault”, and we withheld 5: 5 did not mention Agent Vault. Showing the 1 we can prove is about Agent Vault.
Official links
What are the best Agent Vault alternatives?
The closest alternatives to Agent Vault we list are Clawshell, Aembit and Agentseal. Ranked by direct product-type match, not category overlap.
| Alternative | Pricing | Starts at | Last verified |
|---|---|---|---|
| Clawshell | Free | Free | — |
| Aembit | Freemium | Pricing not published | — |
| Agentseal | Freemium | Pricing not published | — |
Alternatives to Agent Vault
View all
Tools that pair well with Agent Vault
Common stack mates teams adopt alongside Agent Vault, with the specific reason each pairing earns its keep.
Clawshell
Open-source OS-level runtime security that keeps real API keys and PII out of compromised OpenClaw and Hermes Agent processes.
Aembit
Identity control plane that brokers short-lived, policy-scoped credentials for AI agents, MCP servers, and non-human workloads.
Agentseal
Open-source CLI that red-teams AI agent prompts and audits MCP servers with real attack payloads.
Agent Vault vs its closest rival
Agent Vault's closest head-to-head is with Push Security — Choose Push Security if you need a comprehensive browser security platform to defend against AI-powered phishing, session hijacking, and shadow AI usage across all browsers. Choose Agent Vault if you are a developer who needs an open-source way to prevent credential exfiltration from AI coding agents. They solve different problems—Push secures the human browsing experience, Agent Vault secures machine-to-machine agent calls. Verdict generated
Head-to-head comparisons
Agent Vault vs Push Security
Choose Push Security if you need a comprehensive browser security platform to defend against AI-powered phishing, session hijacking, and shadow AI usage across all browsers. Choose Agent Vault if you are a developer who needs an open-source way to prevent credential exfiltration from AI coding agents. They solve different problems—Push secures the human browsing experience, Agent Vault secures machine-to-machine agent calls.
GeneratedAgent Vault vs Mostly Ai
Mostly AI and Agent Vault solve completely different problems. Pick Mostly AI if your priority is generating high-fidelity synthetic data for ML training or analytics under privacy constraints. Pick Agent Vault if you run AI coding agents and need a simple, self-hosted way to stop credential leaks from prompt injection. They complement each other rather than compete.
GeneratedAgent Vault vs Temporal Ai
If you need your AI agents to survive crashes and recover state automatically, choose Temporal AI. If your primary concern is preventing credential exfiltration from AI agents via prompt injection, go with Agent Vault. Both are open-source freemium tools — Temporal focuses on reliability and orchestration; Agent Vault focuses on security and secret isolation.
GeneratedAgent Vault vs Audioeye
These are not competitors — they don't sit on the same shortlist, and you'd never pick one to satisfy the other's requirement. Agent Vault is an infrastructure tool for security-conscious teams running AI agents that currently hold real API keys in their environment; it only makes sense if you can self-host a proxy and maintain per-host service rules. AudioEye is a compliance product for organizations that need to demonstrate ADA/WCAG/Section 508 conformance, produce VPAT/ACR documentation, and reduce legal exposure. Choose Agent Vault for agent credential security; choose AudioEye for web accessibility compliance. If you asked 'which one,' the honest answer is: for what job? They solve separate problems.
GeneratedFrequently asked questions
Used Agent Vault? Help shape our editorial sentiment research.