AgentVault Protocol (AVP)
Open protocol for securing how AI agents access credentials, memory, and environment variables.
What is AVP?
The Agent Vault Protocol (AVP) is an open standard that defines how AI agents securely access credentials, memory, and external systems.
It provides a structured way to control agent permissions, secure credential usage, enforce runtime validation, and track all agent actions.
GitHub: github.com/inflectiv/agent-vault-protocolWhy AVP Exists
AI agents are rapidly expanding into real-world use — interacting with APIs, financial systems, databases, and external services. But there is no standard for how agents should access credentials, be restricted, or be monitored.
AI agents run with full access to your credentials. There's no standard way to:
- Scope which secrets an agent can see
- Encrypt credentials at rest with per-file random salts
- Store agent memory securely with search and expiration
- Audit every credential and memory access decision
- Revoke agent access in real-time
- Redact sensitive values while preserving variable names
- Exchange vaults between tools via a portable format
AVP solves this with a framework-agnostic protocol.
Core Principles of AVP
- Zero Trust by Default — Agents start with no access, permissions must be explicitly granted
- Explicit Permissioning — No implicit access, every action must be defined in a profile
- Mediated Execution — Agents do not access systems directly, all actions go through a control layer
- Full Auditability — Every action is logged, every decision is traceable
- Revocable Access — Permissions can be removed at any time, sessions can be terminated instantly
AVP Components
| Concept | Description |
|---|---|
| Encrypted Vault | AES-256-GCM with scrypt key derivation, random salt per file |
| Memory Store | Encrypted agent memory with keyword search, confidence scoring, TTL |
| Permission Profile | YAML rules: allow / deny / redact, last-match-wins evaluation |
| Audit Trail | Immutable SQLite log of every access decision |
| Session | Bounded execution context with revocation support |
| Portable Vault | Self-contained .avault format for vault exchange |
| MCP Interface | 12 tools for credential and memory access via Model Context Protocol |
| Memory Banks | Packaged knowledge with licensing (unlimited, time-locked, access-limited) |
AVP vs AgentVault
AVP is the protocol. AgentVault is the implementation.
- AVP defines the rules → AgentVault enforces them
- Think of it like: HTTP → Protocol, Browser → Implementation