Access bundles

Lists of services that AI agents can access during a session.

An access bundle defines the list of services (external APIs or MCP servers) that an AI agent can access during a session.

You can reuse access bundles across as many sessions as you like. This makes them useful for scoping what services an agent can access depending on its task. For example, you might have:

• A code-review bundle that grants access to GitHub and Slack
• A customer-feedback bundle that grants access to Discord, Resend, and Slack
• A marketing bundle that grants access to Twilio and Google Docs

​

Create an access bundle

To create a new access bundle:

1. In your Agent Vault project, go to Access Bundles and select Create Access Bundle.

2. Give the bundle a name that says what job it’s for, like code-review or marketing, and optionally a Description.

   
3. Select Create Access Bundle. The access bundle appears in the list.

Now you can add services to the access bundle so agents using it can make authenticated requests. You can also add skills to the access bundle, so the CLI installs your team’s instructions for every agent that starts with it.

​

Manage access to access bundles

Since access bundles provide authentication to external APIs, members of your Agent Vault project can’t create sessions with them by default. They need explicit access for each bundle.

​

Grant access

To allow a user, group, or machine identity to create sessions for a given access bundle:

1. Make sure the user, group, or machine identity is a member of the Agent Vault project. If not, add them under Access Control.

2. Open the access bundle from Access Bundles and select Options > Manage Access.

3. Under No Access, find the user, group, or machine identity, and select Grant Access next to it. The change saves right away.

   

​

Revoke access

To revoke access from a user, group, or machine identity, open the bundle and select Options > Manage Access. Find them with the search box, select Has Access next to them, and select Revoke Access. If any of their agents are running, those agents lose the bundle’s credentials within one poll interval.

​

Set up your personal values

Some services ask you for part of their credential, such as your own API key (see member-provided values), or ask you to connect your own account to an MCP server. Until you set up your personal values for one of these services, your sessions can’t use it, and the service shows Requires Setup. This applies to admins too.

To set up your personal values:

1. In your Agent Vault project, go to Access Bundles and select the access bundle.

2. Select Requires Setup next to the service, or open the service’s actions menu and select Set Up My Personal Values.

   
3. Enter each value. To use one of your personal variables, type {{ or select the arrow at the end of the field, then pick a variable from the list.

   

   For an MCP service that uses OAuth, select Connect Account instead, then sign in to the provider in the pop-up window and approve access. When you approve, Infisical saves the connection, closes the dialog, and the service shows Configured.

   
4. If you entered values, select Save. The service shows Configured.

If the provider stops accepting your login, the service shows Requires Setup again. If an agent needs scopes that your connection doesn’t grant, the service shows Missing Scopes. In either case, select Requires Setup or Missing Scopes next to the service, then select Reconnect. If the message under your connection says the provider refused the service’s OAuth app, reconnecting won’t help. Ask a project admin to update the service.

Infisical never shows your personal values to anyone else, admins included.

• To change your personal values, open the service’s actions menu, select Update My Personal Values, and enter the values you want to change
• To delete your personal values, select Remove in the same dialog, then select Remove Personal Values (Disconnect Account for an OAuth service)

A machine identity sets up its personal values with the set personal values endpoint, and keeps its own personal variables with the create variable endpoint. A machine identity can’t connect an OAuth account. For an MCP service where each member connects their own account, have the machine identity create the session on behalf of a user who has connected theirs.