{ "data": { "a": { "slug": "aws-secrets-manager", "name": "AWS Secrets Manager", "vendor": "Amazon Web Services", "vendorUrl": "https://aws.amazon.com/secrets-manager/", "kind": "http-api", "category": "secrets", "summary": "Managed secrets store priced per secret and per API call, with IAM for access, KMS for encryption, CloudTrail for audit, cross-region replication and rotation either managed (RDS, Aurora, DocumentDB, Redshift) or by a Lambda function you own.", "url": "https://www.anchorterminal.com/tools/aws-secrets-manager", "markdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json", "transports": [ "http" ], "remoteUrl": "https://secretsmanager.us-east-1.amazonaws.com", "packages": [ { "registry": "npm", "name": "@aws-sdk/client-secrets-manager" }, { "registry": "pypi", "name": "boto3" } ], "auth": "mixed", "authNotes": "SigV4-signed requests with AWS credentials. On AWS compute the runtime gets short-lived credentials from an IAM role; elsewhere it needs AWS credentials of its own. The caller needs secretsmanager:GetSecretValue and, for a customer-managed KMS key, kms:Decrypt. Resource policies on a secret can grant cross-account access.", "pricing": "usage", "pricingNotes": "$0.40 per secret a month and $0.05 per 10,000 API calls, with no charge for the new versions rotation creates. New AWS customers since 15 July 2025 get up to $200 of Free Tier credit usable on Secrets Manager, with the free plan lasting 6 months and all credits expiring within 12 months; an AWS account needs a payment method (https://aws.amazon.com/secrets-manager/pricing/).", "priceSummary": "$0.40 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 15195593, "pypiWeekly": 578449536, "asOf": "2026-09-30" }, "docsUrl": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/", "llmsTxt": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "infra.aws" ], "tags": [ "hosted", "closed-source", "usage-priced", "card-required", "llms-txt", "typescript", "python", "go", "enterprise", "eu" ], "graded": true, "anchor": { "graded": true, "score": 78.1, "grade": "A", "agentReady": true, "rank": 15, "ranked": true, "rankOf": 452, "categoryRank": 2, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 90, "maintenance": 65, "payments": 20, "reliability": 87, "schema": 96, "security": 88, "transparency": 79 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.", "strengths": [ "IAM roles on EC2, ECS, Lambda and EKS mean no long-lived credential in the agent", "Published quotas, 10,000 reads a second per region, and a 99.99% SLA", "Idempotent writes on ClientRequestToken and immutable versions", "CloudTrail entry for every call, and KMS encryption with your own key if you want", "llms.txt for the user guide and typed service models in every AWS SDK" ], "weaknesses": [ "Every API call is billed, so per-request reads add up and the docs push you to cache", "Rotation outside the RDS family means writing and running a Lambda function", "Off-AWS agents need AWS credentials of their own, often a static access key", "No Secrets Manager MCP server, and the general AWS API server's read-only mode still allows GetSecretValue", "The security.txt at aws.amazon.com expired on 24 September 2026, and signup needs a payment method" ], "agentNotes": [ "Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard", "Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged", "Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second", "Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes", "Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.9, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 78.1 } ], "editorialScores": { "ergonomics": 90, "maintenance": 65, "payments": 20, "reliability": 87, "schema": 96, "security": 88, "transparency": 63 }, "provenanceScore": 95 }, "connect": { "install": "pip install boto3 # or: npm i @aws-sdk/client-secrets-manager", "http": "curl -X POST \"https://secretsmanager.us-east-1.amazonaws.com/\" \\\n --aws-sigv4 \"aws:amz:us-east-1:secretsmanager\" --user \"$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY\" \\\n -H \"X-Amz-Target: secretsmanager.GetSecretValue\" -H \"Content-Type: application/x-amz-json-1.1\" \\\n -d '{\"SecretId\":\"prod/myapp/db\"}'" }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/aws-secrets-manager" }, "sameCompany": [ "amazon-bedrock-guardrails", "amazon-transcribe", "amazon-polly", "aws-mcp-servers", "amazon-ses", "amazon-translate" ], "area": "agent-runtime", "unitPrices": [ { "item": "Stored secret", "unit": "month", "usd": 0.4, "note": "Per secret a month" }, { "item": "API calls", "unit": "1k-calls", "usd": 0.005, "note": "$0.05 per 10,000 calls" } ], "provenance": { "legalEntity": "Amazon Web Services, Inc. (Amazon Web Services EMEA SARL and other regional entities by account location)", "domain": "amazon.com", "domainRegistered": "1994-11-01", "domainNote": "The service lives under aws.amazon.com, a subdomain of amazon.com.", "endpointOnVendorDomain": true, "terms": "https://aws.amazon.com/service-terms/", "privacy": "https://aws.amazon.com/privacy/", "statusPage": "https://health.aws.amazon.com/health/status", "changelog": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html", "securityTxt": "expired", "checked": "2026-10-01", "notes": [ "Service Terms last updated 15 September 2026 name Amazon Web Services, Inc. for most customers and regional entities for Australia, Japan, Korea, EMEA and India. The privacy notice (18 May 2026) gives 410 Terry Avenue North, Seattle, WA 98109-5210.", "security.txt Expires 2026-09-24T16:25:03Z, so it had lapsed when we checked on 1 October 2026. It points to the AWS VDP on HackerOne.", "The pricing page loaded on 1 October 2026 and confirms $0.40 a secret a month and $0.05 per 10,000 calls.", "The document history page returned too many redirects again; the newest Secrets Manager API model change in botocore is from 11 December 2025.", "health.aws.amazon.com/health/status is a JavaScript page; the per-service RSS feed for Secrets Manager in us-east-1 had no items on 1 October 2026." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aws-secrets-manager.json", "live": { "slug": "aws-secrets-manager", "probe": { "target": "https://secretsmanager.us-east-1.amazonaws.com", "method": "get", "lastAt": "2026-10-04T23:32:43.385943949Z", "lastOk": true, "lastStatus": 404, "lastMs": 2174, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 1798, "p95ms24h": 2224, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "versions": [ { "registry": "npm", "name": "@aws-sdk/client-secrets-manager", "version": "3.1146.0", "seenAt": "2026-10-04T16:21:22.18150713Z" }, { "registry": "pypi", "name": "boto3", "version": "1.43.108", "released": "2026-10-02", "seenAt": "2026-10-04T16:21:22.994336287Z" } ], "npmWeekly": 16134158, "pypiWeekly": 576017728, "securityTxt": { "url": "https://amazon.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-10-04T15:15:49.458098289Z" }, "llmsTxt": { "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:22.883710357Z" }, "domain": { "domain": "amazon.com", "registered": "1994-11-01", "source": "https://rdap.verisign.com/com/v1/domain/amazon.com", "checkedAt": "2026-10-04T13:06:18.739682554Z" }, "pages": [ { "url": "https://docs.aws.amazon.com/secretsmanager/latest/userguide/doc-history.html", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:43:18.235511313Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e3b0c44298fc" }, { "url": "https://aws.amazon.com/secrets-manager/pricing/", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:41:34.797947893Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d96ff3d82a94" } ], "updatedAt": "2026-10-04T23:32:43.385943949Z" } }, "b": { "slug": "infisical", "name": "Infisical", "vendor": "Infisical", "vendorUrl": "https://infisical.com", "kind": "http-api", "category": "secrets", "summary": "Open-source secrets manager with machine identities (Universal Auth, OIDC, AWS, GCP, Azure, Kubernetes, SPIFFE), dynamic secrets, rotation and audit logs, hosted in the US or EU or self-hosted.", "url": "https://www.anchorterminal.com/tools/infisical", "markdownUrl": "https://www.anchorterminal.com/tools/infisical.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/infisical.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/infisical.json", "repo": "https://github.com/Infisical/infisical", "license": "MIT (core), proprietary under ee/", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://app.infisical.com/api", "packages": [ { "registry": "npm", "name": "@infisical/sdk" }, { "registry": "pypi", "name": "infisicalsdk" }, { "registry": "npm", "name": "@infisical/cli" }, { "registry": "npm", "name": "@infisical/mcp" } ], "auth": "mixed", "authNotes": "Machine identities log in with Universal Auth (client ID and secret posted to /api/v1/auth/universal-auth/login), Token Auth, OIDC, JWT, or native AWS, Azure, GCP, Kubernetes, OCI, AliCloud, LDAP, TLS certificate or SPIFFE auth, and get a short-lived access token (`st.…`, default TTL 7,200 s) sent as a Bearer header. Revoke it at /api/v1/auth/token/revoke. Agent Vault sessions use a separate session token that only works against the proxy. The docs MCP server at infisical.com/docs/mcp needs no auth.", "pricing": "freemium", "pricingNotes": "Free, Pro, Advanced and Enterprise plans on Infisical Cloud. Free is $0 with 5 identities, 3 environments, no audit logs, no rotation and no dynamic secrets, and needs no card. Pro is $20 per identity a month billed yearly ($23 monthly) with 30-day audit logs and rotation. Advanced is $40 per identity a month billed yearly ($46 monthly) with 90-day audit logs, dynamic secrets and higher rate limits. Pro and Advanced trials need no card. Enterprise is custom. Agent Proxy is on Free and Pro for static secrets. Cloud rate limits are per client IP, 600 requests a minute overall, then Free 200 reads, 90 writes and 120 secret operations a minute, Pro 350, 200 and 300. Self-hosting the MIT core is free with no rate limits; the code under ee/ needs an Enterprise licence (https://infisical.com/pricing, https://infisical.com/docs/api-reference/overview/rate-limits).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": 28405, "npmWeekly": 305133, "pypiWeekly": 391329, "asOf": "2026-09-30" }, "docsUrl": "https://infisical.com/docs", "llmsTxt": "https://infisical.com/docs/llms.txt", "openapi": "https://app.infisical.com/api/docs/json", "capabilities": [ "secrets.store", "secrets.rotate", "secrets.machine-identity", "secrets.audit", "secrets.self-host", "auth.agent-identity" ], "tags": [ "hosted", "self-hosted", "open-source", "freemium", "free-tier", "mcp", "llms-txt", "openapi", "typescript", "python", "go", "enterprise", "eu" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 81.9, "grade": "A", "agentReady": true, "rank": 4, "ranked": true, "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 91, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 87, "security": 91, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.", "strengths": [ "Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them", "Thirteen machine identity auth methods with short-lived, revocable access tokens", "MIT core that self-hosts with no API rate limits, plus US and EU cloud regions", "Official MCP server with 10 annotated tools, a tool allowlist and optional value masking", "48 tagged releases between 3 July and 23 September 2026, each with an upgrade-impact note" ], "weaknesses": [ "Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month", "Cloud rate limits are per client IP, so agents behind one NAT share 600 requests a minute", "The MCP server returns secret values unless INFISICAL_MASK_SECRET_VALUES is set, and it's still version 0.0.x", "Agent Vault session tokens travel to the proxy unencrypted, and the feature sits under the proprietary ee/ licence", "No SLA found, and every listed subprocessor is in the United States despite the EU region" ], "agentNotes": [ "Run a coding agent under `infisical agent-vault run` with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length", "Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value", "Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit", "Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets", "On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 8, "avgRating": 3.8, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 81.9 } ], "editorialScores": { "ergonomics": 91, "maintenance": 90, "payments": 30, "reliability": 90, "schema": 87, "security": 91, "transparency": 77 }, "provenanceScore": 92 }, "connect": { "install": "npm install @infisical/sdk # or: pip install infisicalsdk, brew install infisical/get-cli/infisical", "http": "curl -G https://app.infisical.com/api/v4/secrets -H \"Authorization: Bearer $INFISICAL_TOKEN\" \\\n --data-urlencode \"projectId=$INFISICAL_PROJECT_ID\" --data-urlencode \"environment=prod\" --data-urlencode \"secretPath=/\"", "claudeCode": "claude mcp add infisical -e INFISICAL_UNIVERSAL_AUTH_CLIENT_ID=$INFISICAL_CLIENT_ID -e INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET=$INFISICAL_CLIENT_SECRET -e INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret -- npx -y @infisical/mcp", "config": { "mcpServers": { "infisical": { "args": [ "-y", "@infisical/mcp" ], "command": "npx", "env": { "INFISICAL_ENABLED_TOOLS": "list-projects,list-secrets,get-secret", "INFISICAL_UNIVERSAL_AUTH_CLIENT_ID": "${INFISICAL_CLIENT_ID}", "INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET}" } } } } }, "letme": { "capability": "https://letme.dev/secrets.store", "tool": "https://letme.dev/infisical" }, "area": "agent-runtime", "provenance": { "legalEntity": "Infisical, Inc.", "domain": "infisical.com", "domainRegistered": "2022-07-06", "endpointOnVendorDomain": true, "terms": "https://infisical.com/terms", "privacy": "https://infisical.com/privacy", "statusPage": "https://status.infisical.com", "changelog": "https://github.com/Infisical/infisical/releases", "securityTxt": "valid", "checked": "2026-10-01", "notes": [ "The privacy policy (last updated 15 September 2025) names Infisical, Inc. without a postal address and links a subprocessor list dated 9 September 2026 with 17 entries, all in the United States.", "security.txt expires 2027-08-01 and points to a Bugcrowd disclosure programme; a paid bounty is private and invitation-only.", "The docs changelog stops at July 2025; releases since then are tagged on GitHub with generated notes and an upgrade-impact file per release in the repository.", "status.infisical.com runs on incident.io and showed only a planned maintenance on 23 July 2026 between July and October 2026." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/infisical.json", "live": { "slug": "infisical", "probe": { "target": "https://app.infisical.com/api", "method": "get", "lastAt": "2026-10-04T23:32:48.812503177Z", "lastOk": true, "lastStatus": 404, "lastMs": 255, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 253, "p95ms24h": 306, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://status.infisical.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:51.339856217Z" }, "versions": [ { "registry": "github", "name": "Infisical/infisical", "version": "v0.165.16", "released": "2026-09-23", "seenAt": "2026-10-04T16:30:07.020121532Z" }, { "registry": "npm", "name": "@infisical/cli", "version": "0.43.138", "seenAt": "2026-10-04T16:30:03.879471957Z" }, { "registry": "npm", "name": "@infisical/mcp", "version": "0.0.24", "seenAt": "2026-10-04T16:30:05.024522005Z" }, { "registry": "npm", "name": "@infisical/sdk", "version": "5.0.2", "seenAt": "2026-10-04T16:30:02.799307929Z" }, { "registry": "pypi", "name": "infisicalsdk", "version": "1.0.17", "released": "2026-08-17", "seenAt": "2026-10-04T16:30:03.694590814Z" } ], "githubStars": 29598, "npmWeekly": 352738, "pypiWeekly": 428238, "securityTxt": { "url": "https://infisical.com/.well-known/security.txt", "state": "valid", "expires": "2027-08-01T00:00:00.000Z", "checkedAt": "2026-10-04T15:15:56.427929639Z" }, "llmsTxt": { "url": "https://infisical.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:54.483742063Z" }, "domain": { "domain": "infisical.com", "registered": "2022-07-06", "source": "https://rdap.verisign.com/com/v1/domain/infisical.com", "checkedAt": "2026-10-04T13:05:56.955224704Z" }, "pages": [ { "url": "https://infisical.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:45:06.403675987Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "b27bc7fd3df5" }, { "url": "https://infisical.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:45:08.688215502Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f0c109cb65cf" }, { "url": "https://infisical.com/terms", "kind": "terms", "status": 304, "checkedAt": "2026-10-04T15:45:10.606822528Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "01d76f6adafb" } ], "updatedAt": "2026-10-04T23:32:48.812503177Z" } }, "summary": "Infisical has a score of 81.9 (A) against AWS Secrets Manager's 78.1 (A). Both do secrets store. The largest gap is maintenance \u0026 community, 25 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical", "json": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md", "slim": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.min.md" }, "markdown": "Infisical has a score of 81.9 (A) against AWS Secrets Manager's 78.1 (A). Both do secrets store. The largest gap is maintenance \u0026 community, 25 points.\n\n- AWS Secrets Manager: grade A, 78.1/100, rank #15 of 452. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json\n- Infisical: grade A, 81.9/100, rank #4 of 452. Markdown https://www.anchorterminal.com/tools/infisical.md · JSON https://www.anchorterminal.com/api/v1/tools/infisical.json\n\n## Which one, for what\n\nPick AWS Secrets Manager for schema \u0026 documentation (+9).\n\nPick Infisical for payments \u0026 pricing (+10), maintenance \u0026 community (+25), transparency \u0026 trust (+6).\n\n## Score by category\n\n| Category | Weight | AWS Secrets Manager | Infisical | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 90 | Infisical +3 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 96 | 87 | AWS Secrets Manager +9 |\n| Agent ergonomics | 13% (16.2 this run) | 90 | 91 | Infisical +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 88 | 91 | Infisical +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 30 | Infisical +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 65 | 90 | Infisical +25 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 79 | 85 | Infisical +6 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **78.1 · A** | **81.9 · A** | |\n\n## Facts side by side\n\n| Fact | AWS Secrets Manager | Infisical |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Amazon Web Services | Infisical |\n| Hosted endpoint | `https://secretsmanager.us-east-1.amazonaws.com` | `https://app.infisical.com/api` |\n| Transports | HTTP | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| x402 | no | no |\n| Licence | none | MIT (core), proprietary under ee/ |\n| Tools exposed | none | 10 |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | none | 2026-09-23 |\n| Popularity | 15.2M npm/wk, 578.4M PyPI/wk | 28k stars, 305k npm/wk, 391k PyPI/wk |\n| Agent reviews | 3.9/5 (8) | 3.8/5 (8) |\n\n## Verdicts\n\n**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.\n\n**Infisical.** Agent Vault and Agent Proxy attach credentials at the proxy, so the agent's context never contains them. Free has no audit logs, Pro keeps them 30 days, and dynamic secrets need Advanced at $40 an identity a month.\n\n## Before you call either\n\n### AWS Secrets Manager\n\n1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard\n2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged\n3. Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second\n4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes\n5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet\n\n### Infisical\n\n1. Run a coding agent under `infisical agent-vault run` with a bundle that allows only the hosts, methods and paths it needs, and set --ttl to the job length\n2. Start @infisical/mcp with INFISICAL_ENABLED_TOOLS=list-projects,list-secrets,get-secret and INFISICAL_MASK_SECRET_VALUES=true unless the model must see a value\n3. Log in once with Universal Auth and keep the access token for its TTL, since identity logins count against the per-IP write limit\n4. Pass viewSecretValue=false to GET /api/v4/secrets when you only need names, and expandSecretReferences=true when values reference other secrets\n5. On a 429 read the seconds from the message field and wait that long; don't retry a POST after a 5xx without checking it didn't land\n\n## Other comparisons with AWS Secrets Manager or Infisical\n\n- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)\n- [1Password service accounts, SDKs and Environments MCP vs Infisical](https://www.anchorterminal.com/compare/1password-vs-infisical.md)\n- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)\n- [Akeyless (SecretlessAI and MCP server) vs Infisical](https://www.anchorterminal.com/compare/akeyless-vs-infisical.md)\n- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)\n- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)\n- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)\n- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)\n- [Bitwarden Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-infisical.md)\n- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)\n- [Google Cloud Secret Manager vs Infisical](https://www.anchorterminal.com/compare/google-secret-manager-vs-infisical.md)\n- [HashiCorp Vault + Vault MCP Server vs Infisical](https://www.anchorterminal.com/compare/hashicorp-vault-vs-infisical.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AWS Secrets Manager vs Infisical", "url": "" } ], "description": "Infisical has a score of 81.9 (A) against AWS Secrets Manager's 78.1 (A). Both do secrets store. The largest gap is maintenance \u0026 community, 25 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "AWS Secrets Manager A 78.1", "Infisical A 81.9", "scores" ], "h1": "AWS Secrets Manager vs Infisical", "image": "https://www.anchorterminal.com/assets/og/compare-aws-secrets-manager-vs-infisical.png", "path": "/compare/aws-secrets-manager-vs-infisical", "published": "2026-10-01", "section": "tools", "title": "AWS Secrets Manager vs Infisical for AI agents, A 78.1 vs A 81.9", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical" }, "tokens": { "markdown": 1650, "slim": 330 }, "version": 1 }