How to Use the Infisical MCP in CrewAI

Q: Can I restrict which CrewAI agents have access to Infisical tools?

Yes, you should use MCPServerHTTP with a toolfilter. This ensures your CrewAI research agent can only run listsecrets while your admin agent gets updatesecret.

Q: How does CrewAI protect raw Infisical environment variables from being logged?

The raw values fetched via getsecret are processed in memory and never written to CrewAI's shared disk or telemetry logs. The MCP Server acts as an ephemeral proxy, ensuring Infisical credentials stay isolated.

Deploy a team of specialized CrewAI agents to audit, rotate, and provision your Infisical secrets autonomously.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Infisical MCP to CrewAI

Create your Vinkius account to connect Infisical to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Infisical with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Multi-agent security audits with CrewAI

One agent shouldn't have all the keys to the kingdom. With this MCP Server, you set up a CrewAI SecOps team where Agent A uses `list_audit_logs` to find suspicious access patterns, while Agent B uses `list_identities` to cross-reference machine permissions. A third CrewAI moderator agent reviews their findings before taking action. This multi-agent setup ensures no single autonomous loop makes critical changes to Infisical without peer review.

Autonomous secret provisioning pipelines

When your development crew spins up a new microservice, your CrewAI agents can provision the required environment variables. The lead agent runs `list_environments` to find the target Infisical space. If the database credentials don't exist, the CrewAI agent runs `create_secret` to generate high-entropy passwords on the fly. Your developers get working Infisical environments without waiting for DevOps tickets.

Automated cleanup of legacy credentials

Leftover credentials in old paths are a major security risk. Your CrewAI cleanup crew uses `list_secrets` to scan deprecated paths across your Infisical environments. When it finds stale or unused keys, the CrewAI agent flags them for deletion. The agent then runs `delete_secret` to safely remove them from Infisical once a supervisor agent signs off.

Setup guide

Set up Infisical MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke Infisical tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="Infisical Analyst",
    goal="Access and analyze Infisical data via MCP.",
    backstory="Expert analyst with direct Infisical access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent Infisical transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="Infisical Analyst",
        goal="Access and analyze Infisical data via MCP.",
        backstory="Expert analyst with direct Infisical access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent Infisical transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Infisical. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Infisical now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Infisical MCP in CrewAI

Pass your Vinkius server URL directly in the CrewAI agent's `mcps` array. CrewAI connects to the endpoint and exposes tools like `get_secret` to that specific agent.

Yes, you should use `MCPServerHTTP` with a `tool_filter`. This ensures your CrewAI research agent can only run `list_secrets` while your admin agent gets `update_secret`.

Agents pass metadata and key names through CrewAI's shared memory. They only invoke `get_secret` when they absolutely need the actual value, keeping exposure minimal across the MCP connection.

CrewAI's internal task manager catches the exception. The CrewAI agent can analyze the error message—such as a key already existing during `create_secret`—and adjust its strategy.

The raw values fetched via `get_secret` are processed in memory and never written to CrewAI's shared disk or telemetry logs. The MCP Server acts as an ephemeral proxy, ensuring Infisical credentials stay isolated.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript