LibreAI / AI Agents / agent-vault
// agents · Infisical/agent-vault

agent-vault

Infisical's credential vault and HTTP proxy, so AI agents call APIs without ever holding your real secrets.

★ 2.3k stars⑂ 163 forksNOASSERTIONupdated 2026-10
▦ visual — this project's README ships no embeddable screenshot,
so here's a placeholder. The guide below is complete regardless.
// project facts

Project facts

agent-vault is an open-source ai agents project by Infisical (Infisical/agent-vault on GitHub). It has 2,323 GitHub stars and 163 forks, is released under the NOASSERTION license, and was last updated on GitHub on 4 October 2026.

GitHub stars
2,323
Forks
163
License
NOASSERTION
Last updated on GitHub
4 October 2026
Category
AI Agents
Listing
Full install guide
Official site
Official site
// how it works

How it works

  1. Clarify your goal

    Decide which credentials your agents should be able to use indirectly, and where the vault will run, ideally on a separate machine from the agents.

  2. Get the project

    Install Agent Vault with the official install script or the Docker image, and start the server with a master password.

  3. Install and configure

    Create a vault, add credentials and service rules that substitute dummy values with real ones, then create an agent and its token.

  4. Run your first task

    Set the agent environment variables, install the CLI on the agent side, and run your agent through Agent Vault so its requests are brokered.

// features

Why people love it

Credential brokering

Agents hold dummy placeholder values; the proxy substitutes real credentials into headers on outbound requests to services such as LLM providers and GitHub.

Pluggable credential stores

Use the built-in local encrypted store, or back a vault with an external secrets store such as Infisical, including dynamic secrets.

Transparent, proxy-based integration

Works with existing MCP tools, CLIs, SDKs, and APIs by bootstrapping the agent environment with HTTPS_PROXY, with no code changes to the agent.

Egress filtering and strict mode

Control which services and endpoints each agent may reach, and optionally deny any request that matches no service rule.

Request logging

Authenticated traffic flowing through the proxy can be inspected to monitor and diagnose agent behaviour.

Single binary with management UI and SDK

The server exposes a management API/UI on port 14321 and the MITM proxy on 14322, and a TypeScript SDK lets orchestrators mint short-lived tokens for sandboxed agents.

Advertisement
// run it

Run it yourself

  1. Clone the project (for building or inspection)

    Most deployments use the install script or Docker image rather than a source build.

    git clone https://github.com/Infisical/agent-vault.git
    cd agent-vault
  2. Install and start the server

    Use the official installer, set a master password, and start the daemon.

    curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh
    export AGENT_VAULT_MASTER_PASSWORD=<your master password>
    agent-vault server -d
  3. Run an agent through the vault

    After creating a vault, credentials, and an agent token in the UI or CLI, launch your agent via the proxy.

    agent-vault run -- claude
// use cases

What you can build

Advertisement
// faq

Questions, answered

Who maintains it?

It is built and maintained by Infisical, the open-source secrets management company.

Is it free to use?

This project is open source and self-hostable at no cost; check the repository license file for exact terms, since the catalog metadata lists it as NOASSERTION. Infisical also sells a commercial, platform-integrated version.

Does it need a paid API key?

Agent Vault does not need an LLM API key itself; it stores and brokers your existing keys for services like Anthropic or GitHub.

How does it compare to a well-known alternative?

Generic forward proxies such as mitmproxy or Squid move traffic but do not broker credentials; Agent Vault is purpose-built to substitute and guard credentials for agent workflows.

How do I get started?

Install it with the get.agent-vault.dev script or Docker, start the server, create a vault and agent token, then run your agent with agent-vault run.

// keep exploring

Similar tools

Agents

qwen-audio-agent

Real-time voice runtime that keeps AI agents talking, working, and present.

★ 2.8k starsApache-2.0
View guide →
AI Agents

omnigent

Omnigent is an open-source AI agent framework and meta-harness: orchestrate Claude Code, Codex, Cursor, Pi, and custom agents — swap harnesses without rewrit…

★ 10.4k starsApache-2.0
View guide →
AI Agents

UI-TARS-desktop

ByteDance's open-source multimodal AI agent stack: GUI agents that see and operate real desktops

★ 39.2k starsApache-2.0
View guide →
AI Agents

dmux

Dev agent multiplexer designed for git worktrees and coding agents.

★ 1.8k starsMIT
View guide →
AI Agents

agenticSeek

A fully local Manus-style autonomous agent: browses, codes and speaks — no APIs, no subscription

★ 27.5k starsGPL-3.0
View guide →
Agents

agent-rules-books

Battle-tested coding rules for AI agents, distilled from classic programming books.

★ 2.9k starsMIT
View guide →
// alternatives

Alternatives in AI Agents

The most-starred other AI Agents projects in the LibreAI catalogue — the realistic shortlist if agent-vault is not the right fit.

Get agent-vault

Free and open — grab the source, star the repo, and start creating.