---
title: "Infisical for AI agents"
description: "What the platform does for agents rather than how to install it, covering Agent Vault for third-party credentials, brokered PAM sessions on your own infrastructure, and agent identity and audit."
canonical: "https://infisical.com/ai-agents.md"
source-index: https://infisical.com/llms.txt
---

# Infisical for AI agents

A credential an agent can read is a credential it can leak. AI agents are a new security surface. Security architecture built for deterministic workloads cannot reliably secure probabilistic AI workloads because they cannot be trusted to not be prompt injected or send keys, tokens, or database strings to LLM providers. Infisical offers two novel ways to secure AI agents:

* Agent Vault, a MITM forward proxy that enables agents to use credentials without holding them by intercepting egress and only attaching credentials at the network boundary. This is useful for tools the agent needs to use repeatedly.
* Agentic PAM access which brokers sessions to sensitive resources. This is useful for one-time access to help on-call engineers resolve incidents.

The underlying pattern is that the agent never sees a raw secret, so it cannot leak anything. The credential stays in Infisical, a broker attaches it at the network boundary, and the agent works with placeholders and local ports. Nothing in the agent's context, environment, filesystem, or transcript contains a real value, so there is nothing for an injected instruction to exfiltrate.

## Which mechanism to use

| The agent needs to                                          | Use                      | CLI Entry point                            |
|-------------------------------------------------------------|--------------------------|--------------------------------------------|
| Call a third-party API, CLI, or MCP server                  | **Agent Vault**          | `infisical agent-vault run`                |
| Query your own database, or reach your own host             | **PAM agentic access**   | `infisical pam agentic access`             |
| Read and manage secrets as tool calls                       | **Infisical MCP server** | `npx -y @infisical/mcp`                    |
| Look up current Infisical docs instead of guessing at flags | **Docs MCP server**      | [docs/mcp](https://infisical.com/docs/mcp) |

## Agent Vault: third-party APIs and tools

Agent Vault puts a forward proxy between the agent and the HTTP services it calls, and points the agent's HTTP clients at it with the standard `HTTPS_PROXY` variable. The real credentials stay in Infisical. The agent authenticates to the proxy with a time-bound session token, and the proxy attaches the real credential as each request leaves your network.

CLI example, after creating an access bundle, enrolling a proxy, and creating a session:

```bash
infisical agent-vault run --session-token <session-token> --proxy <proxy-host>:17323 -- claude
```

Or let the CLI open the session itself, as your user or as a machine identity:

```bash
infisical agent-vault run --access-bundle code-review --proxy <proxy-host>:17323 --ttl 8h -- codex
```

Anything that honors `HTTPS_PROXY` works, with no SDK and no code change in the agent. That covers Claude Code, Codex, OpenCode, Hermes Agent, and OpenClaw, which have step-by-step guides, plus custom harnesses, `curl`, `git`, `gh`, and most SDKs. Targets are anything that authenticates over HTTP: third-party APIs, CLIs, MCP servers, and more.

**Access bundles decide what an agent can reach.** An access bundle is a list of services, one per external API, usually grouped by job. Each service maps a host to a credential, which the proxy attaches as a header or substitutes where the agent sent a placeholder. Any service can be narrowed to certain HTTP methods and path prefixes, and the proxy's **Access bundle hosts only** traffic policy refuses every host outside the bundle.

**Sessions are time-bound and revocable.** A session grants one access bundle until it expires (`--ttl 30m`, `8h`, `7d`, or `never`) or someone revokes it. Revocations, removed grants, and deleted bundles reach running agents within one poll interval, 60 seconds by default, without a restart.

**Every agent run has an owner.** Sessions are created by a user or a machine identity, so each agent's access traces back to who started it. Give an unattended agent its own machine identity, grant it the bundles it needs, and its sessions belong to it.

**Session logs show what the agent did.** Every request the proxy handles is recorded with its method, host, path, status, matched service, and outcome (`brokered`, `passthrough`, `blocked`, or `error`), encrypted and stored in an S3 bucket you own. Creating and revoking sessions also writes audit events.

**Proxies run where traffic leaves your network.** Enroll one with a single command, using the CLI, Docker, or systemd, preferably on a different machine from the agent. Agent Vault does not sandbox the agent; pair it with a sandbox if the agent should not reach other local resources.

[platform/agent-vault.md](https://infisical.com/platform/agent-vault.md): every supported harness and service template, limits, and FAQ. [Agent Vault docs](https://infisical.com/docs/documentation/platform/agent-vault/overview): access bundles, services, sessions, session logs, and proxies.

## PAM agentic access: your own databases and servers

The same shape, applied to infrastructure instead of APIs. Privileged access management brokers sessions, not credentials. One command opens the accounts the agent is allowed to reach as ports on `127.0.0.1`, hands the agent instructions describing them, and starts it inside an OS-level sandbox.

CLI example:

```bash
infisical pam agentic access --account prod/orders-db --account prod/bastion -- claude
```

**The gateway holds the credential** and injects it on the far side, at the database or host. The agent connects to a local port, authenticates to nothing, and stores nothing. Ports open before anything is connected, so a session starts only when the agent actually reaches for an account, and it is subject to the usual role, duration, and approval checks when it does.

**Scope it deliberately.** `--account` specifies which accounts you intend rather. `--duration` caps the session and defaults to `1h`. `--reason` is required when an account's template demands one.

**Approvals still apply.** Any approval policy in Infisical PAM also applies to agentic requests. If no request is required,`--no-approval-request` skips filing one. Approval policies might require human approval or automatically approve the agent.

**The sandbox closes the side doors.** It blocks the paths an agent would take to your Infisical credentials or a container runtime it could escape through while giving it the working directory and ordinary development files alone. Implemented with bubblewrap on Linux. The`--no-sandbox` disables it if necessary.

**Claude Code, Codex, and Gemini are recognized by name** and told what they can reach in their own instruction format. Override the detection with `--agent`, or use `--agent generic` for an agent you wrote yourself, which reads the same instructions from an environment variable.

**Attribution follows the login.** Run it as yourself and sessions are attributed to you. Give the agent its own machine identity and they belong to it, appearing as a machine identity in the audit log. Unattended runs authenticate that way.

Environment variables:

```bash
export INFISICAL_AUTH_METHOD=universal-auth
export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<id>
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<secret>
```

Sessions are recorded and replayable, so an agent's work on a resource is reviewable after the fact.

[PAM for AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview): full flag reference, sandbox details, and unattended runs.

## Identity and audit

**One machine identity per agent.** A machine identity is a non-human principal that authenticates to Infisical. To preserve ideal auditing, each agent should have their own identity. Scope each to the narrowest project, environment, and path access it needs. In Agent Vault, grant the identity only the access bundles its job needs. In PAM, grant it only the accounts its job needs.

**Know what each agent did.** Agent Vault session logs record every outbound request an agent made through the proxy, and PAM records every session on your own infrastructure. Both attribute the activity to the user or machine identity that started the agent.

**Prefer a native auth method** where the platform has one (AWS, GCP, Azure, Kubernetes, OIDC), because the workload proves its own platform identity and there is no standing credential to store or leak. Universal Auth is the portable fallback.

[Machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities): auth methods, scoping, and token lifetimes.

## AI provider credentials

Infisical stores, rotates, and brokers them: Anthropic, OpenAI, OpenRouter, LiteLLM, and Fireworks are all supported as direct app connections, with rotation available for their key types.

[App connections](https://infisical.com/docs/integrations/app-connections): AI providers alongside cloud and infrastructure connections. [Secret rotations](https://infisical.com/docs/documentation/platform/secret-rotation/overview#secret-rotation) to see which keys Infisical can natively rotate.

## Getting started

Connect an agent to current documentation to help you with setups. The docs MCP server is `https://infisical.com/docs/mcp` over streamable HTTP, so any MCP client can use it.

MCP config, the shape most clients accept:

```json
{
  "mcpServers": {
    "infisical-docs": {
      "type": "http",
      "url": "https://infisical.com/docs/mcp"
    }
  }
}
```

Codex reads TOML instead, in `~/.codex/config.toml`:

```toml
[mcp_servers.infisical-docs]
url = "https://infisical.com/docs/mcp"
```

CLI example, where the client offers a shortcut for the same thing:

```bash
claude mcp add --transport http infisical-docs https://infisical.com/docs/mcp
```

## Docs

[Agent Vault](https://infisical.com/docs/documentation/platform/agent-vault/overview) · [PAM for AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview) · [CLI: agent-vault](https://infisical.com/docs/cli/reference#agent-vault) · [CLI: pam agentic access](https://infisical.com/docs/cli/commands/pam-agentic) · [Docs index](https://infisical.com/docs/llms.txt)