Akeyless (SecretlessAI and MCP server) vs Doppler

Akeyless (SecretlessAI and MCP server)

Gateway-brokered SecretlessAI and a runtime-authority MCP server with 4 tools that return results, not credentials. No published prices above the free plan; clients and transactions are metered with overage billed at the end of a 12-month contract.

Doppler

Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.

Akeyless (SecretlessAI and MCP server)

1. Run akeyless mcp-runtime-authority, not akeyless mcp, for an agent that acts on systems; the first returns results, the second has get_secret and get_password
2. Authenticate with a cloud identity, Kubernetes or Universal Identity rather than an access key, which the docs reserve for proofs of concept
3. Use CLI 1.130.0 or later for either MCP server, and point the client at your Gateway URL
4. Count identities and calls before scaling. The free plan allows 5 clients, and calls over a tier's cap (200 a minute on Silver) are billed as extra clients, not refused
5. Pass the token in the JSON body of each POST, and page /list-items with pagination-token

Doppler

1. Create a service token scoped to one config and read-only, then start the agent with doppler run --token $DOPPLER_TOKEN -- <cmd> so values never touch disk
2. Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail
3. Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call
4. On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer
5. Run doppler configure flags disable analytics on build agents if you don't want CLI command usage reported