Mock tokens for untrusted agents
The agent works with mock tokens rather than real card numbers or passwords, reducing the impact of a prompt injection or compromised agent context.
Agent Vault
Agent Vault lets AI agents make card payments and sign in with mock tokens, while vaulting credentials with limits, allowlists, isolation, and revocation.
Virtual cards and logins for AI agents
Agent Vault is a security layer for AI agents that need to complete credit-card payments or sign in to websites. Users store card and login credentials in the vault, then give agents mock tokens that can be used in place of the real values.
When an agent reaches a checkout or sign-in form, the real credential is substituted inside an isolated enclave that the agent cannot see. The site says the enclave’s traffic is tunneled through the user’s own machine by default, so the merchant usually sees a transaction arriving from the user’s IP address. Agent Vault also combines credential isolation with spending policies, session separation, and revocation controls.
Key features
Enclave-based credential substitution
Real card values are looked up and entered inside an isolated enclave at checkout. The proxy holds only an opaque token, while the merchant receives an ordinary payment transaction.
Multi-level spending limits
Create per-transaction, daily, weekly, and monthly spending caps. Agent Vault can automatically pause a card when a limit is exceeded.
Merchant allowlists
Optional merchant allowlists restrict where a card can be used, adding a policy layer beyond spending caps.
Immediate kill switch
Revoke a card or login at any time. The site states that revocation takes effect immediately.
Isolated browser sessions
Each session uses a separate browser context, preventing cookies, storage, and cache from crossing between sessions. Idle proxy sessions end after 15 minutes.
Use cases
Supervised online purchasing
Let an agent complete online purchases without exposing a usable card number in its context. Spending caps and merchant allowlists can constrain the transaction.
Website sign-ins
Provide an agent with a site-specific login token so it can sign in while the underlying username and password remain vaulted and are swapped at submission.
Separated browser automation
Run multiple agents or tasks in separate browser sessions when shared cookies, storage, or cache could cause accounts or workflows to overlap.
Controlled ongoing tasks
Give agents access to recurring payment or account workflows while retaining the ability to revoke a card or login immediately if a task should stop.
Pros and Cons
Pros
- Agents receive mock tokens instead of usable card numbers or passwords.
- Spending can be constrained with per-transaction, daily, weekly, and monthly caps and optional merchant allowlists.
- Cards and logins can be revoked immediately with a kill switch.
- Separate browser contexts prevent cookies, storage, and cache from crossing between sessions.
- The site identifies a PCI-DSS Level 1 vault and describes encrypted-at-rest storage keyed per tenant.
Cons
- The source does not provide pricing, plan limits, setup documentation, or a complete list of supported integrations.
- The workflow depends on proxy sessions and browser contexts; proxy sessions end after 15 minutes of inactivity.
FAQ
How does Agent Vault work with an AI agent?
You store your credentials once and scope each agent in the dashboard. The agent receives mock tokens, while the real card or login value is looked up and entered inside the isolated enclave when needed.
Can the agent see the real card number?
The agent receives tokens that have no usable card value. The real card details are not handed to the agent; the enclave types them into the checkout form on the trusted side of the boundary.
What controls are available for card spending?
Yes. Cards can have per-transaction, daily, weekly, and monthly caps, with optional merchant allowlists. The product also provides a kill switch that can revoke a card or login immediately, and it describes automatic pausing when a limit is exceeded.
How are agent sessions isolated?
Each session runs in its own browser context, and cookies, storage, and cache do not cross between sessions. Proxy sessions end after 15 minutes of inactivity.
Quick Facts
- Category
- AI agent security and credential management
- Primary users
- People using AI agents to make payments or log into websites
- Protected credentials
- Payment cards and website login credentials
- Agent workflow
- Mock tokens are submitted by the agent; real values are substituted inside an isolated enclave
- Session model
- Separate browser context per session
- Source domain
- agentvault.io
Agent Vault Alternatives
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
GitBot
GitBot is a local browser workspace for reusable coding bots powered by Claude Code, Codex, or OpenCode, with persistent threads and configurable permissions.
AakarDev AI
AakarDev AI helps teams manage AI provider access, project setup, logs, and analytics in one dashboard. BYOK support included.
Trigger.dev chat agent
Trigger.dev chat agent is a durable AI chat backend for stateful conversations that survive refreshes, crashes, and long-running turns with AI SDK useChat.
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
Epherem
Epherem scans web apps built with Lovable, Bolt, v0, Replit, Cursor, and Claude Code for security flaws in source code and dependencies, without running the app.