Agent Vault – Open-source credential proxy and vault for agents

Intercepts credential requests from AI agents at runtime and routes them through a centralized proxy layer that validates, masks, and logs access patterns. Implements a man-in-the-middle architecture for credential flows, allowing agents to request secrets by logical name rather than storing or managing raw credentials directly, with support for multiple credential backends and rotation policies.

Establishes cryptographic identity for each AI agent through a registration and authentication system that issues agent-specific tokens or certificates. Uses these identities to enforce access policies, ensuring only authorized agents can request specific credentials, with support for multiple authentication methods (API keys, mTLS, JWT tokens) and identity lifecycle management.

Encrypts credentials at rest in the vault storage and in transit between agents and the proxy using industry-standard encryption (AES-256, TLS 1.3). Supports key management including key rotation, and can optionally use external key management services (AWS KMS, Azure Key Vault) for key storage. Encryption is transparent to agents.

Evaluates fine-grained access policies at request time to determine whether an authenticated agent is authorized to access a specific credential. Policies are defined declaratively (e.g., 'agent X can access credentials tagged with environment=prod') and evaluated against agent identity, credential metadata, and contextual attributes, with support for policy versioning and audit logging of policy decisions.

Provides a unified interface to multiple credential storage backends (Infisical, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, etc.) through a pluggable adapter pattern. Agents request credentials by logical name without knowing which backend stores them, and the proxy handles backend-specific authentication, retrieval, and error handling transparently.

Captures detailed logs of every credential request including agent identity, requested credential, timestamp, access decision (allowed/denied), and response metadata. Logs are structured (JSON) and can be exported to external logging systems (ELK, Splunk, CloudWatch) for analysis, compliance reporting, and security investigation. Supports log retention policies and filtering.

Manages credential lifecycle including creation, rotation, and expiration through scheduled policies and manual triggers. When a credential is rotated, the proxy updates the stored value and can optionally notify agents or invalidate cached credentials, ensuring agents always access current credentials without manual intervention. Supports rotation scheduling (e.g., every 90 days) and rotation history tracking.

Provides SDKs (likely in Python, JavaScript/TypeScript, Go) and HTTP client libraries that agents use to request credentials from the vault proxy. SDKs handle authentication, error handling, credential caching (optional), and retry logic, abstracting away the proxy protocol details. Supports both synchronous and asynchronous credential requests.

Allows credentials to be tagged with metadata (environment, sensitivity level, owner, rotation policy, etc.) that can be used for access control policies, filtering, and organization. Metadata is queryable and can be used to implement dynamic access policies (e.g., 'agents can access credentials tagged with their environment'). Supports custom metadata fields.

Provides deployment options (Docker container, standalone binary, Kubernetes Helm chart) and configuration management for the vault service itself. Supports configuration via environment variables, config files, or API, with hot-reload for non-critical settings. Includes health checks, metrics export, and integration with container orchestration platforms.

Implements rate limiting and throttling on credential requests to prevent abuse, excessive load, or denial-of-service attacks. Supports per-agent rate limits, per-credential rate limits, and global rate limits, with configurable thresholds and backoff strategies. Rejected requests return appropriate error codes and guidance for retry.