Infisical releases an Agent Proxy that keeps provider keys outside agent machines

• Infisical open-sourced Agent Vault and Agent Proxy to keep service keys outside agent runtimes, as the announcement explains.
• The remote design separates agent and proxy hosts; the deployment explanation puts credential injection on the second machine.
• Existing tools retain authenticated access: the release examples include OpenCode using GitHub CLI and calling Anthropic without holding either service’s real key.

The proxy supports static and dynamically generated secrets. The failure behavior is refreshingly specific: if Infisical becomes unreachable, cached session data survives five polling intervals before affected requests fail with HTTP 502.

Agent Vault holds the service credentials. Agent Proxy retrieves them and attaches authentication to requests after they leave the agent environment.

OpenCode routes requests through Agent Proxy, which retrieves credentials from Agent Vault.

OpenCode is the worked example in the release post:

• Invoke gh to open a pull request without holding a GitHub personal access token.
• Connect to Anthropic without holding an Anthropic API key.

The interception happens at the HTTP layer, so CLI tools and local MCP servers can keep their existing interfaces, according to a follow-up. Their outbound requests pass through the same credential broker.

The remote arrangement in the deployment explanation separates two hosts:

1. Machine A: runs the agent, with proxy environment variables routing its HTTP requests to Machine B.
2. Machine B: runs Agent Proxy, fetches credentials from Agent Vault and attaches them to outbound requests.

Colocation weakens that boundary. The deployment documentation warns that an agent on the proxy’s machine could read its state directory, including the proxy access token and certificate authority private key.

Infisical also distinguishes remote deployments from local agents that already have access to a developer’s filesystem in the discussion.

Agent Vault policies determine which credentials get attached to requests for particular domains.

The proxy’s traffic policy adds a separate control over reachable destinations:

• Any host, the default: forwards every request, attaching credentials only where a service matches.
• Access bundle hosts only: rejects hosts outside the session’s services, except configured exceptions.
• Method and path rules: requests that violate a service’s rules receive HTTP 403 under either traffic policy.
• Exception hosts: receive no injected credentials and are available to every agent using that proxy.

The agent still holds a session token, used as the proxy password in the documented setup. That token grants access through the broker even though the underlying provider keys remain elsewhere.

Application secrets remain a separate exposure. Infisical’s earlier explanation separately cautioned against giving agents access to production secrets.

The proxy documentation spells out the transport requirements:

• HTTPS interception: the proxy decrypts requests to attach credentials, so agents must trust its generated certificate authority.
• Client trust: the setup names SSL_CERT_FILE and NODE_EXTRA_CA_CERTS for configuring certificate trust.
• Supported traffic: HTTP/1.1 over HTTPS or plain HTTP.
• Unsupported connections: WebSockets and HTTP/2-only clients, including gRPC clients, fail through the proxy.

The interface-agnostic design therefore depends on the client’s proxy and transport support. Infisical’s Agent Proxy overview defines compatible agents as programs that respect HTTPS_PROXY.

Infisical pointed to two existing deployments of the same architectural pattern:

• Claude Tag: provisioned credentials stay outside isolated sandboxes, and Anthropic-hosted requests leave through Agent Proxy, as dangtony98 noted and Anthropic’s security documentation describes.
• Perplexity Sandbox: sandboxes have no direct network access; an external egress proxy matches destination domains and injects credentials. That is the design dangtony98 pointed to in Perplexity’s March announcement.

Infisical Cloud charges for Agent Vault by the number of requests for which credentials are brokered. Infisical also says the setup can be self-hosted for free.