Infisical MCP Server
Infisical's MCP server: an agent reads and edits secrets, projects and environments, with value masking and a tool allowlist
- 77 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The server reads, creates, updates and deletes secrets and invites project members on behalf of a machine identity.
- By default responses carry real secret values, and they enter the model context.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/infisical-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The server reads, creates, updates and deletes secrets and invites project members on behalf of a machine identity.
- By default responses carry real secret values, and they enter the model context.
This is third-party code. Review the repository files before installing.
What it does
The official Infisical MCP server starts with `npx -y @infisical/mcp` and gives an agent ten tools: reading, creating, updating and deleting secrets, listing projects, creating projects, environments and folders, and inviting members to a project. Sign-in goes through a Machine Identity (Universal Auth) or an access token, and the Infisical cloud address can be replaced with your own server. To keep values away from the agent, set `INFISICAL_MASK_SECRET_VALUES=true`: responses show `<masked>` instead of values, and on Infisical Cloud and v0.116.0 or newer the values never reach the server or the model at all. The `INFISICAL_ENABLED_TOOLS` variable keeps only the listed tools, for example `list-projects,list-secrets,get-secret`. For every call the server writes a JSON line to stderr; secret values and tokens stay out of the log.
Who it is for. Teams that keep secrets in Infisical and let an agent inspect project variables or set up environments and folders.
Good fit when
- An agent checks which keys exist in the `staging` environment and lists names without values.
- For a new service, one request creates a project, the `dev` and `prod` environments and folders.
- An application fails at startup, and the agent checks whether the required secret exists at the given path.
- Colleagues get invited to a project with the right roles without opening the Infisical dashboard.
- Infisical runs on your own server, and the address is set through `INFISICAL_HOST_URL`.
Not a fit when
- Secret values must not reach even the local server process: on Infisical older than v0.116.0 they reach the server, and the mask only replaces them in responses.
- The access identity is issued for the whole organization and cannot be narrowed to the projects and environments you need.
- The agent must not delete secrets: `delete-secret` and `update-secret` are on by default until the tool list is restricted.
- The audit must capture every call: `list-projects` is the one call Infisical does not write to its own log.
Example request
List the secret names in the `staging` environment of the billing project without revealing values.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
INFISICAL_UNIVERSAL_AUTH_CLIENT_IDrequired- Machine Identity client ID for Universal Auth.
INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRETrequired, secret- Machine Identity client secret for Universal Auth.
INFISICAL_TOKENsecret- Access token when `INFISICAL_AUTH_METHOD=access-token`.
INFISICAL_HOST_URL- Address of your own Infisical server, the cloud by default.
INFISICAL_ENABLED_TOOLS- Comma-separated allowlist of tools.
INFISICAL_MASK_SECRET_VALUES- `true` hides secret values in responses.
Limitations
All ten tools are on and secret values are returned by default, as in earlier versions, so you set the mask and the tool allowlist yourself. A Machine Identity or an access token is required: the identity's rights decide what the agent can see and change. The secret tools use API v4, and on self-hosted Infisical older than v0.150.0 the server falls back to the deprecated v3 routes on its own. A failed tool call returns an error in the result text, not a JSON-RPC error.
How to disable. Remove the `infisical` block from the MCP client configuration and revoke the Machine Identity key in the Infisical dashboard. For a partial shutdown keep only the read tools in `INFISICAL_ENABLED_TOOLS`.
FAQ
How do I connect Infisical MCP to a client?
Add the command `npx -y @infisical/mcp` to the MCP configuration with the sign-in variables: `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` and `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET`, or `INFISICAL_AUTH_METHOD=access-token` with `INFISICAL_TOKEN`. Restart the client after editing the configuration.
How do I keep secret values away from the agent?
Set `INFISICAL_MASK_SECRET_VALUES=true`. Responses then show `<masked>` instead of values, and on Infisical Cloud and v0.116.0 or newer the values do not even reach the server.
How do I leave the agent read-only?
List the tools you want in `INFISICAL_ENABLED_TOOLS`: `list-projects,list-secrets,get-secret`. The rest are hidden from the list and refused when called.
Does the server work with self-hosted Infisical?
Yes, `INFISICAL_HOST_URL` sets the server address and defaults to `https://app.infisical.com`. On versions below v0.150.0 the secret tools switch to the v3 routes.
Which tools does the server have?
Ten: `create-secret`, `delete-secret`, `update-secret`, `list-secrets`, `get-secret`, `create-project`, `create-environment`, `create-folder`, `invite-members-to-project` and `list-projects`. Only `list-secrets`, `get-secret` and `list-projects` are read-only.
Discussion
No questions or reviews yet.
Related
MCP serversMCP Observatory: security testing for MCP servers
MCP Observatory
An MCP server scanner: checks schemas, drift and attack behavior, runs in CI and as an MCP server for agents
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
A CLI for auditing agent MCP servers: inventory, evidence per server and a CI policy where unmeasured never counts as clean
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
ls-mcp finds MCP servers across Claude, Cursor and other editors, shows which are running and warns about keys in settings.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Infisical MCP Server (this card) | yes | API key | 77 | |
| Vault MCP Server | yes | API key | 67 | works with the HashiCorp Vault store; Infisical MCP manages Infisical secrets, projects and environments and can mask values |
| Bitwarden MCP Server | yes | API key | 319 | talks to the Bitwarden password vault; Infisical MCP is built for development secrets and application environments |
README in short
The project documents the sign-in variables, ten tools with a read-only flag, the tool allowlist, value masking, the call log on stderr and a table of the API routes the server calls.