<!-- Agent-readable view of https://infisical.com/ai-agents.md -->
<!-- Site index: https://infisical.com/llms.txt -->

# Infisical for AI agents

A credential an agent can read is a credential it can leak. AI agents are a new security surface. Security architecture built for deterministic workloads cannot reliably secure probabilistic AI workloads because they cannot be trusted to not be prompt injected or send keys, tokens, or database strings to LLM providers. Infisical offers two novel ways to secure AI agents:

* A MITM Agent Proxy that enables agents to use credentials without holding them by intercepting egress and only attaching credentials at the network boundary. This is useful for tools the agent needs to use repeatedly.
* Agentic PAM access which brokers sessions to sensitive resources. This is useful for one-time access to help on-call engineers resolve incidents.

The underlying pattern is that the agent never sees a raw secret, so it cannot leak anything. The credential stays in Infisical, a broker attaches it at the network boundary, and the agent works with placeholders and local ports. Nothing in the agent's context, environment, filesystem, or transcript contains a real value, so there is nothing for an injected instruction to exfiltrate.

## Which mechanism to use

| The agent needs to                                          | Use                      | CLI Entry point                            |
|-------------------------------------------------------------|--------------------------|--------------------------------------------|
| Call a third-party API, CLI, or MCP server                  | **Agent Proxy**          | `infisical secrets agent-proxy run`        |
| Query your own database, or reach your own host             | **PAM agentic access**   | `infisical pam agentic access`             |
| Read and manage secrets as tool calls                       | **Infisical MCP server** | `npx -y @infisical/mcp`                    |
| Look up current Infisical docs instead of guessing at flags | **Docs MCP server**      | [docs/mcp](https://infisical.com/docs/mcp) |

## Agent Proxy: third-party APIs and tools

Infisical runs a forward proxy in the agent's environment and points the agent's HTTP clients at it with the standard `HTTPS_PROXY` variable. The agent sends a placeholder, the proxy swaps in the real credential as the request leaves, and the call goes out authenticated.

CLI example:

```bash
infisical secrets agent-proxy run --projectId=<id> --env=dev --path=/coding-agent -- claude
```

Anything that honors `HTTPS_PROXY` works, with no SDK and no code change in the agent, which covers essentially every agent harness including Claude Code, Codex, OpenClaw, Pi, and others. Targets are anything requiring authentication: third-party APIs, CLIs, MCP servers, and more.

**Three deployment modes.** `run` starts a local proxy and launches the agent behind it, for agents that live in a terminal session. `start` runs a standalone proxy on its own host, for cloud-based agents. `connect` attaches an agent to a proxy that is already running.

**A proxied service maps a host to a credential.** You define a host pattern (wildcards and ports allowed) and a rule for applying the credential: bearer token, an API key header, basic auth, or an arbitrary custom header. Secret substitution covers services that want the credential somewhere other than a header, injecting it into the URL path, query string, or request body. Services can reference a static secret, an imported one, or a dynamic secret that mints a short-lived lease per use.

**Bound the egress explicitly.** You can customize which hosts are allowed and disallowed and define policies for defaults outside of those specific hosts. `--unmatched-host` defaults to `allow`, which forwards requests to unrecognized hosts untouched. Pass `--unmatched-host=block` to reject them with a `403` and restrict the agent to services you have configured.

**Every brokered request is logged**, so the record shows what the agent called and when.

Agent Proxy is available on any Infisical plan, including free. It is also available on the MIT-licensed open-source version. [Agent Proxy](https://infisical.com/docs/documentation/platform/agent-proxy/overview): deployment modes, proxied services, sandbox behavior, and activity logs.

## PAM agentic access: your own databases and servers

The same shape, applied to infrastructure instead of APIs. Privileged access management brokers sessions, not credentials. One command opens the accounts the agent is allowed to reach as ports on `127.0.0.1`, hands the agent instructions describing them, and starts it inside an OS-level sandbox.

CLI example:

```bash
infisical pam agentic access --account prod/orders-db --account prod/bastion -- claude
```

**The gateway holds the credential** and injects it on the far side, at the database or host. The agent connects to a local port, authenticates to nothing, and stores nothing. Ports open before anything is connected, so a session starts only when the agent actually reaches for an account, and it is subject to the usual role, duration, and approval checks when it does.

**Scope it deliberately.** `--account` specifies which accounts you intend rather. `--duration` caps the session and defaults to `1h`. `--reason` is required when an account's template demands one.

**Approvals still apply.** Any approval policy in Infisical PAM also applies to agentic requests. If no request is required,`--no-approval-request` skips filing one. Approval policies might require human approval or automatically approve the agent.

**The sandbox closes the side doors.** It blocks the paths an agent would take to your Infisical credentials or a container runtime it could escape through while giving it the working directory and ordinary development files alone. Implemented with bubblewrap on Linux. The`--no-sandbox` disables it if necessary.

**Claude Code, Codex, and Gemini are recognized by name** and told what they can reach in their own instruction format. Override the detection with `--agent`, or use `--agent generic` for an agent you wrote yourself, which reads the same instructions from an environment variable.

**Attribution follows the login.** Run it as yourself and sessions are attributed to you. Give the agent its own machine identity and they belong to it, appearing as a machine identity in the audit log. Unattended runs authenticate that way.

Environment variables:

```bash
export INFISICAL_AUTH_METHOD=universal-auth
export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=<id>
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=<secret>
```

Sessions are recorded and replayable, so an agent's work on a resource is reviewable after the fact.

[PAM for AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview): full flag reference, sandbox details, and unattended runs.

## Identity and audit

**One machine identity per agent.** A machine identity is a non-human principal that authenticates  to Infisical. To preserve ideal auditing, each agent should have their own identity. Scope each to the narrowest project, environment, and path access it needs.

**Prefer a native auth method** where the platform has one (AWS, GCP, Azure, Kubernetes, OIDC), because the workload proves its own platform identity and there is no standing credential to store or leak. Universal Auth is the portable fallback.

[Machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities): auth methods, scoping, and token lifetimes.

## AI provider credentials

Infisical stores, rotates, and brokers them: Anthropic, OpenAI, OpenRouter, LiteLLM, and Fireworks are all supported as direct app connections, with rotation available for their key types.

[App connections](https://infisical.com/docs/integrations/app-connections): AI providers alongside cloud and infrastructure connections. [Secret rotations](https://infisical.com/docs/documentation/platform/secret-rotation/overview#secret-rotation) to see which keys Infisical can natively rotate.

## Getting started

Connect an agent to current documentation to help you with setups. The docs MCP server is
`https://infisical.com/docs/mcp` over streamable HTTP, so any MCP client can use it.

MCP config, the shape most clients accept:

```json
{
  "mcpServers": {
    "infisical-docs": {
      "type": "http",
      "url": "https://infisical.com/docs/mcp"
    }
  }
}
```

Codex reads TOML instead, in `~/.codex/config.toml`:

```toml
[mcp_servers.infisical-docs]
url = "https://infisical.com/docs/mcp"
```

CLI example, where the client offers a shortcut for the same thing:

```bash
claude mcp add --transport http infisical-docs https://infisical.com/docs/mcp
```

## Docs

[Agent Proxy](https://infisical.com/docs/documentation/platform/agent-proxy/overview) · [PAM for AI agents](https://infisical.com/docs/documentation/platform/pam/ai-agents/overview) · [CLI: agent-proxy](https://infisical.com/docs/cli/commands/agent-proxy) · [CLI: pam agentic access](https://infisical.com/docs/cli/commands/pam-agentic) · [Docs index](https://infisical.com/docs/llms.txt)