Compare
Forkbench vs Infisical Agent Proxy
Infisical Agent Proxy, generally available since 30 July 2026, is a secrets broker you deploy: agents point HTTPS_PROXY at it, and it swaps the dummy credential the agent holds for the real one before the request leaves for its destination.
Updated
Infisical Agent Proxy is infrastructure: you deploy it, agents route their requests through it, and it swaps a dummy credential for the real one at the network boundary. Forkbench is the Mac app the agents run in, where a key belongs to one Thread alongside its plan, its notes and its people.
These two agree on the conclusion and disagree about where it belongs. Infisical's own framing is that the agent proxy "represents a new kind of infrastructure primitive, alongside sandboxes", and they have built it as infrastructure: deploy it beside the agent or standalone for a whole network, on any operating system, self-hosted if you want. Forkbench is not infrastructure. It is the Mac app the agents are already running in, which is what lets the key be scoped to the piece of work rather than to the machine identity that fetched it.
| Forkbench | Infisical Agent Proxy | |
|---|---|---|
| What it is | A Mac app where your agents run, one Thread per piece of work | A secrets broker you deploy, part of the Infisical platform |
| Where it sits | In the app the agent runs in | Between the agent and the internet: local, or standalone for a network |
| What a grant is scoped to | A Thread: its keys, its notes, its board and its people | A machine identity, and its project and environment |
| A key aimed at the wrong host | Blocked and logged; the destination is set when the key is created | Not published |
| Folder scope the kernel enforces | Yes, per Thread, inherited by every process a shell spawns | Not part of it: the boundary it draws is the network |
| Setup | Install the app | Deploy the proxy, point HTTPS_PROXY at it, hold identities in Infisical |
| Where it runs | macOS 13+ | macOS, Windows, Linux; also a Docker container |
| Self-hosting and source | Closed, and there is nothing to host | MIT core, self-hostable; Agent Vault is MIT on GitHub |
| The work itself | A board and notes that outlive the session, shared with the people on the Thread | Not what it does; it brokers the credential |
| Price | Free; Pro €30/mo; Team $30/seat, dropping to $20 at scale | Free tier includes Agent Proxy for static secrets; Pro $20/identity/mo annual; Advanced $40 |
Where Infisical Agent Proxy is strong
- It serves a fleet. A standalone deployment "runs on a host of its own and serves agents across your network", which is a thing a Mac app is not trying to be.
- It is free on every tier for static secrets. In their launch release: "included across all pricing tiers, including the complimentary tier. No upgrades, enablement, or additional purchases are required." Dynamic secrets through the proxy need Advanced or Enterprise.
- Cross-platform and self-hostable. The CLI runs on macOS, Windows and Linux, the proxy also ships as a Docker container, and the core platform is MIT.
- Agent Vault, the open-source predecessor it grew out of, is on GitHub under MIT with more than 2,000 stars and is still maintained, so you can read the mechanism rather than take it on trust.
- There is a full secrets platform underneath it: machine identities, projects and environments, dynamic secrets, 30-plus integration presets. If your problem is company-wide secrets management, that is what Infisical is for and Forkbench is not.
Where Forkbench differs
- The grant is a piece of work, not a machine identity. A Thread holds its own plan, its own notes, its own keys and its own people, so what an agent may reach is decided by the job it was put on, and everything outside that Thread is deny by default.
- Put the key in Vault and the command that needs it receives the value while the agent receives the result, so the key stays out of the prompt, the command line and the transcript. It is containment rather than a guarantee: a command you authorised can still print what it was handed. Vault is part of Pro.
- A key is locked to its destination when it is created, and an agent cannot change that later. Forkbench restricts which hosts a key may reach, and blocks and logs the rest.
- Folders the macOS kernel enforces. A Thread can be locked to the folders the job is about, applied as each shell starts and inherited by every process it spawns, so a build script and a dependency's install hook are inside the same boundary.
- Nothing to deploy, and nothing else to run. The keys, the notes the agent reads and the board it claims work from are all one Thread's, on the Mac where the agent already is.
The bottom line
If the agents you are worried about run on servers, in containers or across a team, Infisical is the right shape and Forkbench is the wrong one: deploy the proxy, self-host the platform, and get it free on the tier you are already on. If the agents you are worried about run on your own Mac, the question stops being how a credential is brokered, because both answers are good, and becomes which job a credential belongs to. That is what a Thread decides, and it decides the notes, the board and the people in the same breath.
Infisical Agent Proxy questions
Can I use Infisical and Forkbench together?
Yes. Every Forkbench pane is a real login shell, so the Infisical CLI and a locally running Agent Proxy work exactly as they do in any terminal. A common split is company-wide secrets in Infisical and the one or two keys a particular job needs in that Thread's Vault, so the agent working it has those and nothing else.
Does Forkbench work for agents running on servers or in CI?
No. Forkbench is a native macOS app and the work happens on the Mac in front of you, so a fleet of agents on Linux hosts is Infisical's problem to solve, not ours. Agent Proxy has a standalone mode built for exactly that, it is free for static secrets on every tier, and the core platform is MIT if you would rather host it yourself.
Both keep the value away from the agent. What is actually different?
What the boundary is drawn around. Agent Proxy draws it at the network: requests go through it and the real credential is attached on the way out. Forkbench draws it around the piece of work: a Thread holds its keys, its notes, its board and its people, a key is locked to its destination when it is created, and anything aimed elsewhere is blocked and logged.
Keep reading
Sources
Comparison based on publicly available information, checked on the date above. Spot something out of date? Tell us.