Installation

Get a server running in under a minute.

Agent Vault ships as a single binary that acts as both a server and CLI client.

Each install method below configures a master password at startup. Store it somewhere safe. The password wraps the data encryption key and is held only in memory once the server is unlocked.

Script

Auto-detects your OS and architecture (macOS on Intel or Apple Silicon, Linux on x86_64 or ARM64), downloads the latest release, and installs.

curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL https://get.agent-vault.dev | sh

Start the Agent Vault server (pass -d to run in the background):

export AGENT_VAULT_ADDR="http://<your-host>:14321"
agent-vault server

Docker

docker run -it -p 14321:14321 -p 14322:14322 \
  -e AGENT_VAULT_MASTER_PASSWORD=your-password \
  -e AGENT_VAULT_ADDR="http://<your-host>:14321" \
  -v agent-vault-data:/data infisical/agent-vault

See Docker deployment for Compose, volumes, and full configuration.

From source

Prerequisites: Go 1.25+, Node.js 22+

git clone https://github.com/Infisical/agent-vault.git
cd agent-vault
make build
sudo mv agent-vault /usr/local/bin/

Start the Agent Vault server (pass -d to run in the background):

export AGENT_VAULT_ADDR="http://<your-host>:14321"
agent-vault server

Agent Vault exposes two listeners: the HTTP API on 14321 and the transparent MITM proxy on 14322 (the canonical ingress for agents).

Open http://<your-host>:14321/register (the hostname or address where you deployed Agent Vault) to create your account. The first user becomes the instance owner with admin on the default vault.

Next steps

Connect an agent

Setup guides for Claude Code, Cursor, Codex, and more.

PostgreSQL for production

Run multiple instances with a shared Postgres database.

Need to verify the release signature or upgrade later? See Maintenance.