> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access bundles

> Lists of services that AI agents can access during a session.

An access bundle defines the list of [services](https://infisical.com/docs/documentation/platform/agent-vault/services) (external APIs or MCP servers) that an AI agent can access during a [session](https://infisical.com/docs/documentation/platform/agent-vault/sessions).

You can reuse access bundles across as many sessions as you like. This makes them useful for scoping what services an agent can access depending on its task. For example, you might have:

* A **code-review** bundle that grants access to GitHub and Slack
* A **customer-feedback** bundle that grants access to Discord, Resend, and Slack
* A **marketing** bundle that grants access to Twilio and Google Docs

![The Access Bundles page of the Engineering Agents project, listing the code-review, on-call, and release-notes access bundles with their service icons and member counts](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundles-list.png)

## Create an access bundle

To create a new access bundle:

**Step 1**

In your Agent Vault project, go to **Access Bundles** and select **Create Access Bundle**.

**Step 2**

Give the bundle a name that says what job it's for, like **code-review** or **marketing**, and optionally a **Description**.

![The Create Access Bundle dialog with deploy-checks as the name and a description](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-create.png)

**Step 3**

Select **Create Access Bundle**. The access bundle appears in the list.

Now you can [add services](https://infisical.com/docs/documentation/platform/agent-vault/services) to the access bundle so agents using it can make authenticated requests. You can also [add skills](https://infisical.com/docs/documentation/platform/agent-vault/skills.md#add-a-skill-to-an-access-bundle) to the access bundle, so the CLI installs your team's instructions for every agent that starts with it.

## Manage access to access bundles

Since access bundles provide authentication to external APIs, members of your Agent Vault project can't create sessions with them by default. They need explicit access for each bundle.

### Grant access

To allow a user, group, or machine identity to create sessions for a given access bundle:

**Step 1**

Make sure the user, group, or machine identity is a member of the Agent Vault project. If not, [add them under Access Control](https://infisical.com/docs/documentation/platform/agent-vault/access-control.md#adding-members).

**Step 2**

Open the access bundle from **Access Bundles** and select **Options** > **Manage Access**.

**Step 3**

Under **No Access**, find the user, group, or machine identity, and select **Grant Access** next to it. The change saves right away.

![The Manage Access sheet for code-review, listing four members with Has Access and, under No Access, the other members with a Grant Access button each](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-manage-access.png)

### Revoke access

To revoke access from a user, group, or machine identity, open the bundle and select **Options** > **Manage Access**. Find them with the search box, select **Has Access** next to them, and select **Revoke Access**. If any of their agents are running, those agents lose the bundle's credentials within one [poll interval](https://infisical.com/docs/documentation/platform/agent-vault/proxies.md#poll-interval).

## Set up your personal values

Some services ask you for part of their credential, such as your own API key (see [member-provided values](https://infisical.com/docs/documentation/platform/agent-vault/http-apis.md#member-provided-values)), or ask you to connect your own account to an [MCP server](https://infisical.com/docs/documentation/platform/agent-vault/mcp-servers.md#leave-the-credential-to-each-member). Until you set up your personal values for one of these services, your sessions can't use it, and the service shows **Requires Setup**. This applies to admins too.

To set up your personal values:

**Step 1**

In your Agent Vault project, go to **Access Bundles** and select the access bundle.

**Step 2**

Select **Requires Setup** next to the service, or open the service's actions menu and select **Set Up My Personal Values**.

![The on-call access bundle, with a banner saying two services require your personal values, and a Requires Setup badge on the notion MCP service and the slack service](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/access-bundle-requires-setup.png)

**Step 3**

Enter each value. To use one of your [personal variables](https://infisical.com/docs/documentation/platform/agent-vault/variables.md#personal-variables), type `{{` or select the arrow at the end of the field, then pick a variable from the list.

![The Set Up Personal Values for slack dialog, with a partly typed reference in the Slack token field and the SLACK\_USER\_TOKEN personal variable in the list](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/personal-values.png)

For an MCP service that uses OAuth, select **Connect Account** instead, then sign in to the provider in the pop-up window and approve access. When you approve, Infisical saves the connection, closes the dialog, and the service shows **Configured**.

![The Set Up Personal Values for notion dialog, showing that your mcp.notion.com account isn't connected yet, with a Connect Account button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/agent-vault/personal-values-oauth.png)

**Step 4**

If you entered values, select **Save**. The service shows **Configured**.

If the provider stops accepting your login, the service shows **Requires Setup** again. If an agent needs scopes that your connection doesn't grant, the service shows **Missing Scopes**. In either case, select **Requires Setup** or **Missing Scopes** next to the service, then select **Reconnect**. If the message under your connection says the provider refused the service's OAuth app, reconnecting won't help. Ask a project [admin](https://infisical.com/docs/documentation/platform/agent-vault/access-control.md) to update the service.

Infisical never shows your personal values to anyone else, admins included.

* To change your personal values, open the service's actions menu, select **Update My Personal Values**, and enter the values you want to change
* To delete your personal values, select **Remove** in the same dialog, then select **Remove Personal Values** (**Disconnect Account** for an OAuth service)

A machine identity sets up its personal values with [the set personal values endpoint](https://infisical.com/docs/api-reference/endpoints/agent-vault-services/set-personal-values.md), and keeps its own personal variables with [the create variable endpoint](https://infisical.com/docs/api-reference/endpoints/agent-vault-variables/create.md). A machine identity can't connect an OAuth account. For an MCP service where each member connects their own account, have the machine identity create the session [on behalf of a user](https://infisical.com/docs/documentation/platform/agent-vault/sessions-on-behalf-of-users.md) who has connected theirs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.