Sallyport and Infisical
Open source, a public price, and approval at the session rather than the call.
Infisical is a good secrets platform with an agent vault, a proxy and a privileged access product. Most of it is under a permissive licence, priced in public at $20 per identity. Four free projects in this category exist, and this is one of the best of them.
| Them | Sallyport | |
|---|---|---|
| Open source | Yes, for most of it | The executor and the verifier |
| Approval granularity | Per session | Per call, with the exact call on the card |
| Interception | A local certificate authority in their agent vault | A broker the agent points at, with no certificate to install |
| Tamper-evident journal | Logging | Hash-chained, sealed, with an open verifier |
Where they are ahead
A mature secrets platform with rotation, dynamic secrets and integrations across every runtime, plus the option of running the whole thing yourself today.
Where the difference is
Their agent vault intercepts traffic by putting its own certificate authority on the machine. That breaks pinning, and it gives an agent a proxy variable it can simply ignore. We are a destination the agent points at, and a call that misses us gets no key at all.