From ef6e6d318766edadbcb48363bdd6bfcff93679cf Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:07:55 +0530
Subject: [PATCH 01/11] docs: point to Infisical Agent Proxy from readme and
docs
---
README.md | 9 +++++++++
docs/installation.mdx | 3 +++
docs/snippets/enterprise-cta.mdx | 5 ++++-
3 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 54bd524b..eac69f1b 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,15 @@ By default, requests not matching any service forward as plain proxy traffic; fl
Read the full backstory behind Agent Vault [here](https://infisical.com/blog/agent-vault-the-open-source-credential-proxy-and-vault-for-agents).
+## Agent Vault and Infisical Agent Proxy
+
+[Infisical](https://infisical.com) offers two ways to broker credentials to agents.
+
+- **Agent Vault** is the self-contained, open-source option: a single MIT-licensed binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
+- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and agent access all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and identity-based access control.
+
+For most use cases we recommend Agent Proxy. It takes less to set up, and it is where our work on brokering credentials to agents is focused going forward.
+
## Use Cases
Agent Vault works with all kinds of AI Agent use-cases including secure remote coding agents, all-purpose agents, custom agents + harnesses, secure ephemeral sandboxes and more.
diff --git a/docs/installation.mdx b/docs/installation.mdx
index 4baa8403..7906bfee 100644
--- a/docs/installation.mdx
+++ b/docs/installation.mdx
@@ -4,9 +4,12 @@ description: "Get a server running in under a minute."
---
import InstallCommand from "/snippets/install-command.mdx";
+import EnterpriseCTA from "/snippets/enterprise-cta.mdx";
Agent Vault ships as a single binary that acts as both a server and CLI client.
+
+
Each install method below configures a master password at startup. Store it somewhere safe. The password wraps the [data encryption key](/learn/security) and is held only in memory once the server is unlocked.
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index 67f37ab5..d1b926f7 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,4 +1,7 @@
- **Need an enterprise-grade solution?** Infisical offers managed Agent Vault with enterprise support, SLAs, and advanced features.
+ **Looking for a more complete solution?**
+ [Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)
+ brokers credentials to agents from within Infisical, so your secrets, the services they
+ are brokered to, and access control all live in one place.
[Book a demo with us](https://infisical.com/schedule-demo) to learn more.
From a7a9de7ad414b9f7c65d8236d4deabd208f0f3bd Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:16:07 +0530
Subject: [PATCH 02/11] docs: reword agent proxy recommendation
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index eac69f1b..00fa0b7c 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
- **Agent Vault** is the self-contained, open-source option: a single MIT-licensed binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and agent access all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and identity-based access control.
-For most use cases we recommend Agent Proxy. It takes less to set up, and it is where our work on brokering credentials to agents is focused going forward.
+For most use cases we recommend Agent Proxy. There is less to set up, and brokering lives alongside the rest of your secrets management instead of in a system of its own.
## Use Cases
From 68f6b8b8b03e82708e1e97c4ca865ad6a49e28b9 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:17:21 +0530
Subject: [PATCH 03/11] docs: drop license mention from agent vault bullet
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 00fa0b7c..d1062fa3 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
[Infisical](https://infisical.com) offers two ways to broker credentials to agents.
-- **Agent Vault** is the self-contained, open-source option: a single MIT-licensed binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
+- **Agent Vault** is the self-contained, open-source option: a single binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and agent access all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and identity-based access control.
For most use cases we recommend Agent Proxy. There is less to set up, and brokering lives alongside the rest of your secrets management instead of in a system of its own.
From 7f8cef1e4d37fda130bed12193be9af4eb6d36a1 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:18:01 +0530
Subject: [PATCH 04/11] docs: drop comparative framing from agent proxy callout
---
docs/snippets/enterprise-cta.mdx | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index d1b926f7..653e95f9 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,7 +1,6 @@
- **Looking for a more complete solution?**
- [Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)
- brokers credentials to agents from within Infisical, so your secrets, the services they
- are brokered to, and access control all live in one place.
+ **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** brokers credentials to
+ agents from within Infisical, so your secrets, the services they are brokered to, and
+ access control all live in one place.
[Book a demo with us](https://infisical.com/schedule-demo) to learn more.
From f922571a1e79307ef379e0d13d1cfbacce2aff31 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:18:55 +0530
Subject: [PATCH 05/11] docs: lead agent proxy callout with a framing question
---
docs/snippets/enterprise-cta.mdx | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index 653e95f9..91c2812f 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,5 +1,6 @@
- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** brokers credentials to
+ **Want credential brokering built into Infisical?**
+ [Infisical Agent Proxy](https://infisical.com/blog/agent-proxy) brokers credentials to
agents from within Infisical, so your secrets, the services they are brokered to, and
access control all live in one place.
[Book a demo with us](https://infisical.com/schedule-demo) to learn more.
From 1cbc7c55e8cb782051ea3a5211dbd4da2b43552f Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:27:51 +0530
Subject: [PATCH 06/11] docs: reword agent proxy callout hook
---
docs/snippets/enterprise-cta.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index 91c2812f..56f0d669 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,5 +1,5 @@
- **Want credential brokering built into Infisical?**
+ **Looking for credential brokering inside Infisical?**
[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy) brokers credentials to
agents from within Infisical, so your secrets, the services they are brokered to, and
access control all live in one place.
From 599efcfaf701ab9222cf32cc2e821a93e6dfb8a1 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:30:32 +0530
Subject: [PATCH 07/11] docs: restore managed solution hook on agent proxy
callout
---
docs/snippets/enterprise-cta.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index 56f0d669..45efa3b5 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,5 +1,5 @@
- **Looking for credential brokering inside Infisical?**
+ **Looking for a managed solution?**
[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy) brokers credentials to
agents from within Infisical, so your secrets, the services they are brokered to, and
access control all live in one place.
From 372b415cd7447c24beb26663a7f1e233c199565e Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:43:10 +0530
Subject: [PATCH 08/11] docs: use access control wording in agent proxy bullet
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index d1062fa3..d8923498 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
[Infisical](https://infisical.com) offers two ways to broker credentials to agents.
- **Agent Vault** is the self-contained, open-source option: a single binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
-- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and agent access all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and identity-based access control.
+- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and versioning.
For most use cases we recommend Agent Proxy. There is less to set up, and brokering lives alongside the rest of your secrets management instead of in a system of its own.
From 11a6430db5b907d4d6f343c73b77855f984b0c27 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:45:24 +0530
Subject: [PATCH 09/11] docs: add and more to agent proxy feature list
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index d8923498..2feff8d7 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,7 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
[Infisical](https://infisical.com) offers two ways to broker credentials to agents.
- **Agent Vault** is the self-contained, open-source option: a single binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
-- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, and versioning.
+- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, versioning, and more.
For most use cases we recommend Agent Proxy. There is less to set up, and brokering lives alongside the rest of your secrets management instead of in a system of its own.
From cca6ec3d1478a6d286732eddc2562f5128dc4437 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Fri, 31 Jul 2026 01:22:23 +0530
Subject: [PATCH 10/11] docs: address review feedback on agent proxy
positioning
---
README.md | 6 +++---
docs/snippets/enterprise-cta.mdx | 7 +++----
2 files changed, 6 insertions(+), 7 deletions(-)
diff --git a/README.md b/README.md
index 2feff8d7..4d3879f9 100644
--- a/README.md
+++ b/README.md
@@ -44,10 +44,10 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
[Infisical](https://infisical.com) offers two ways to broker credentials to agents.
-- **Agent Vault** is the self-contained, open-source option: a single binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
-- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the native option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, versioning, and more.
+- **Agent Vault** is the simpler, self-contained option: a single open-source binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
+- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the commercial-grade option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, versioning, and more.
-For most use cases we recommend Agent Proxy. There is less to set up, and brokering lives alongside the rest of your secrets management instead of in a system of its own.
+For production and enterprise use cases we recommend Agent Proxy.
## Use Cases
diff --git a/docs/snippets/enterprise-cta.mdx b/docs/snippets/enterprise-cta.mdx
index 45efa3b5..d4d77919 100644
--- a/docs/snippets/enterprise-cta.mdx
+++ b/docs/snippets/enterprise-cta.mdx
@@ -1,7 +1,6 @@
- **Looking for a managed solution?**
- [Infisical Agent Proxy](https://infisical.com/blog/agent-proxy) brokers credentials to
- agents from within Infisical, so your secrets, the services they are brokered to, and
- access control all live in one place.
+ **Need an enterprise-grade solution?** Infisical offers
+ [Agent Proxy](https://infisical.com/blog/agent-proxy) with enterprise support, SLAs, and
+ advanced features.
[Book a demo with us](https://infisical.com/schedule-demo) to learn more.
From daed125c19b4a70758947d5b91d9316a0352e7f9 Mon Sep 17 00:00:00 2001
From: saif <11242541+saifsmailbox98@users.noreply.github.com>
Date: Fri, 31 Jul 2026 01:26:02 +0530
Subject: [PATCH 11/11] docs: note agent proxy is available on every plan
---
README.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 4d3879f9..6bcadea6 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ Read the full backstory behind Agent Vault [here](https://infisical.com/blog/age
- **Agent Vault** is the simpler, self-contained option: a single open-source binary that stores credentials itself and runs entirely on infrastructure you control, with no dependency on any other system.
- **[Infisical Agent Proxy](https://infisical.com/blog/agent-proxy)** is the commercial-grade option, built directly into Infisical. Your secrets, the services they are brokered to, and access control all live in one place, and it comes with everything Infisical supports around secrets management, including dynamic secrets, secret rotation, versioning, and more.
-For production and enterprise use cases we recommend Agent Proxy.
+For production and enterprise use cases we recommend Agent Proxy. It is part of Infisical Secrets Management and available on every plan, including the free one.
## Use Cases