Agent Vault
An HTTP credential proxy and vault that sits between AI agents and the APIs they call, so agents route requests through it instead of holding API keys directly, reducing the risk of credentials leaking through prompt injection.
Agent Vault is a credential broker built for AI agents such as Claude Code, OpenClaw, Hermes and custom harnesses. Instead of giving an agent a real API key, its credentials are stored in the vault and the agent's traffic is routed through an HTTPS proxy that substitutes dummy placeholder values in outbound request headers with the real credential before forwarding it to the target service.
This is meant to close the specific risk of credential exfiltration, where an agent tricked by a prompt injection could otherwise read and leak a key it holds directly. The vault can be backed by its own local encrypted store or by an external secrets store such as Infisical for dynamic secrets, integrates transparently with existing MCP servers, CLIs, SDKs and APIs without code changes, and can filter which agents may reach which services and endpoints.
It is written in Go and ships with a dedicated CLI and support for multiple tenants.