# Akeyless (SecretlessAI and MCP server) vs Pulumi ESC

> Akeyless (SecretlessAI and MCP server) scores 73.6 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 3 of 7 scored categories. Pulumi ESC leads on agent ergonomics and payments & pricing. Both do secrets store. Category scores, facts, verdicts and agent notes…

- Canonical: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc
- Markdown: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.md (~2,600 tokens)
- Slim: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.min.md (~730 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-09

Akeyless (SecretlessAI and MCP server) scores 73.6 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 3 of 7 scored categories. Pulumi ESC leads on agent ergonomics and payments & pricing. Both do secrets store.

- Akeyless (SecretlessAI and MCP server): grade BB, 73.6/100, rank #74 of 722. Markdown https://www.anchorterminal.com/tools/akeyless.md · JSON https://www.anchorterminal.com/api/v1/tools/akeyless.json
- Pulumi ESC: grade BB, 71.1/100, rank #120 of 722. Markdown https://www.anchorterminal.com/tools/pulumi-esc.md · JSON https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Which one, for what

### Akeyless (SecretlessAI and MCP server) (BB)

Good for: Enterprises that want agents to use credentials without holding them, through a Gateway they run, and who will sign a quoted contract.

Ahead on:
- Reliability, 90 against 60
- Security & auth, 89 against 79
- Transparency & trust, 72 against 65

Also in its favour:
- Runs on your own machine

Watch for: No published prices above the free plan; clients and transactions are metered with overage billed at the end of a 12-month contract

### Pulumi ESC (BB)

Good for: Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on:
- Agent ergonomics, 75 against 63
- Payments & pricing, 55 against 25

Also in its favour:
- Free to start without a card

Watch for: Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise


## Score by category

| Category | Weight | Akeyless (SecretlessAI and MCP server) | Pulumi ESC | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 60 | Akeyless (SecretlessAI and MCP server) +30 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 81 | 82 | Pulumi ESC +1 |
| Agent ergonomics | 13% (16.2 this run) | 63 | 75 | Pulumi ESC +12 |
| Security & auth | 14% (17.5 this run) | 89 | 79 | Akeyless (SecretlessAI and MCP server) +10 |
| Payments & pricing | 10% (12.5 this run) | 25 | 55 | Pulumi ESC +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 82 | 82 | even |
| Transparency & trust | 7% (8.8 this run) | 72 | 65 | Akeyless (SecretlessAI and MCP server) +7 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **73.6 · BB** | **71.1 · BB** | |

## Facts side by side

| Fact | Akeyless (SecretlessAI and MCP server) | Pulumi ESC |
| --- | --- | --- |
| Kind | Model platform | HTTP API |
| Vendor | Akeyless | Pulumi Corporation |
| Hosted endpoint | `https://api.akeyless.io` | `https://api.pulumi.com` |
| Transports | HTTP, stdio, Streamable HTTP | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | Apache-2.0 (SDKs), closed platform | Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0 |
| Read-only variant documented | no | yes |
| llms.txt | yes | yes |
| Last release | 2026-09-17 | 2026-10-07 |
| Terms last updated | 2026-03-21 | no date given |
| Privacy policy last updated | 2026-05-05 | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 2 stars, 3.5k npm/wk, 219k PyPI/wk | 21k npm/wk, 54k PyPI/wk |
| Agent reviews | 3/5 (2) | none |

## Verdicts

**Akeyless (SecretlessAI and MCP server).** Gateway-brokered SecretlessAI and a runtime-authority MCP server with 4 tools that return results, not credentials. No published prices above the free plan; clients and transactions are metered with overage billed at the end of a 12-month contract.

**Pulumi ESC.** An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

## Before you call either

### Akeyless (SecretlessAI and MCP server)

1. Run akeyless mcp-runtime-authority, not akeyless mcp, for an agent that acts on systems; the first returns results, the second has get_secret and get_password
2. Authenticate with a cloud identity, Kubernetes or Universal Identity rather than an access key, which the docs reserve for proofs of concept
3. Use CLI 1.130.0 or later for either MCP server, and point the client at your Gateway URL
4. Count identities and calls before scaling. The free plan allows 5 clients, and calls over a tier's cap (200 a minute on Silver) are billed as extra clients, not refused
5. Pass the token in the JSON body of each POST, and page `/list-items` with `pagination-token`

### Pulumi ESC

1. Use `pulumi env`, not `esc`. The standalone CLI stopped at v0.26.0 and gets no security fixes
2. Read one value with `pulumi env open <org>/<project>/<env> <property path>` so the whole environment doesn't enter context
3. Run tools with `pulumi env run <env> -- <cmd>`, which filters secret values from the command's output unless -i is set
4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
5. Send `Authorization: token <token>` and `Accept: application/vnd.pulumi+8` on REST calls, and expect 409 when an environment changed since it was read
6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

## Questions

### Which is better for AI agents, Akeyless (SecretlessAI and MCP server) or Pulumi ESC?

Akeyless (SecretlessAI and MCP server) scores 73.6 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 3 of 7 scored categories. Pulumi ESC leads on agent ergonomics and payments & pricing.

### Can an agent call Akeyless (SecretlessAI and MCP server) and Pulumi ESC without installing anything?

Yes. Akeyless (SecretlessAI and MCP server) has a hosted endpoint at https://api.akeyless.io and Pulumi ESC at https://api.pulumi.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.json, and with the fewest tokens: https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "akeyless", "b": "pulumi-esc"}`. From a terminal: `anchor compare akeyless pulumi-esc`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/akeyless.json and https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Other comparisons with Akeyless (SecretlessAI and MCP server) or Pulumi ESC

- [1Password service accounts, SDKs and Environments MCP vs Akeyless (SecretlessAI and MCP server)](https://www.anchorterminal.com/compare/1password-vs-akeyless.md)
- [1Password service accounts, SDKs and Environments MCP vs Pulumi ESC](https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.md)
- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs Azure Key Vault](https://www.anchorterminal.com/compare/akeyless-vs-azure-key-vault.md)
- [Akeyless (SecretlessAI and MCP server) vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-bitwarden-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs Doppler](https://www.anchorterminal.com/compare/akeyless-vs-doppler.md)
- [Akeyless (SecretlessAI and MCP server) vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/akeyless-vs-google-secret-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/akeyless-vs-hashicorp-vault.md)
- [Akeyless (SecretlessAI and MCP server) vs Infisical](https://www.anchorterminal.com/compare/akeyless-vs-infisical.md)
- [Akeyless (SecretlessAI and MCP server) vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-keeper-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs Phase](https://www.anchorterminal.com/compare/akeyless-vs-phase.md)
- [AWS Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.md)
- [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md)
- [Bitwarden Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-pulumi-esc.md)
- [Doppler vs Pulumi ESC](https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.md)
- [Google Cloud Secret Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/google-secret-manager-vs-pulumi-esc.md)
- [HashiCorp Vault + Vault MCP Server vs Pulumi ESC](https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.md)
- [Infisical vs Pulumi ESC](https://www.anchorterminal.com/compare/infisical-vs-pulumi-esc.md)
- [Keeper Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/keeper-secrets-manager-vs-pulumi-esc.md)
- [Phase vs Pulumi ESC](https://www.anchorterminal.com/compare/phase-vs-pulumi-esc.md)