Sallyport and Infisical
Open source with a public price; approval covers a whole session at once.
Infisical is a good secrets platform with an agent vault, a proxy and a privileged access product. Most of it is under a permissive licence, priced in public at $20 per identity. Four free projects in this category exist, and this is one of the best of them.
| Them | Sallyport | |
|---|---|---|
| Open source | Yes, for most of it | Closed; the journal export is signed and chained |
| Approval granularity | Per session | Per call, with the exact call on the card |
| Interception | A local certificate authority in their agent vault | A broker the agent points at, with no certificate to install |
| Tamper-evident journal | Logging | Hash-chained, signed per entry, keys published |
Where they are ahead
A mature secrets platform with rotation, dynamic secrets and integrations across every runtime, plus the option of running the whole thing yourself today.
Where the difference is
Their agent vault intercepts traffic by putting its own certificate authority on the machine. That breaks pinning, and it gives an agent a proxy variable it can simply ignore. We are a destination the agent points at, and a call that misses us gets no key at all.