# Doppler vs Pulumi ESC

> Doppler and Pulumi ESC score within a point of each other on agent readiness, 71.4 (BB) and 71.1 (BB). Pulumi ESC leads on agent ergonomics, payments & pricing and maintenance & community. Both do secrets store. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc
- Markdown: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.md (~2,400 tokens)
- Slim: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.min.md (~680 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-08

Doppler and Pulumi ESC score within a point of each other on agent readiness, 71.4 (BB) and 71.1 (BB). Pulumi ESC leads on agent ergonomics, payments & pricing and maintenance & community. Both do secrets store.

- Doppler: grade BB, 71.4/100, rank #110 of 722. Markdown https://www.anchorterminal.com/tools/doppler.md · JSON https://www.anchorterminal.com/api/v1/tools/doppler.json
- Pulumi ESC: grade BB, 71.1/100, rank #120 of 722. Markdown https://www.anchorterminal.com/tools/pulumi-esc.md · JSON https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Which one, for what

### Doppler (BB)

Good for: Teams that want a hosted store and a one-line `doppler run` wrapper for agents, with config-scoped read-only tokens.

Ahead on:
- Reliability, 90 against 60
- Transparency & trust, 74 against 65

Also in its favour:
- Runs on your own machine

Watch for: Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts

### Pulumi ESC (BB)

Good for: Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on:
- Agent ergonomics, 75 against 59
- Payments & pricing, 55 against 25
- Maintenance & community, 82 against 76

Watch for: Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise


## Score by category

| Category | Weight | Doppler | Pulumi ESC | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 90 | 60 | Doppler +30 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 81 | 82 | Pulumi ESC +1 |
| Agent ergonomics | 13% (16.2 this run) | 59 | 75 | Pulumi ESC +16 |
| Security & auth | 14% (17.5 this run) | 82 | 79 | Doppler +3 |
| Payments & pricing | 10% (12.5 this run) | 25 | 55 | Pulumi ESC +30 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 76 | 82 | Pulumi ESC +6 |
| Transparency & trust | 7% (8.8 this run) | 74 | 65 | Doppler +9 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **71.4 · BB** | **71.1 · BB** | |

## Facts side by side

| Fact | Doppler | Pulumi ESC |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Doppler | Pulumi Corporation |
| Hosted endpoint | `https://api.doppler.com/v3` | `https://api.pulumi.com` |
| Transports | HTTP, stdio | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | Apache-2.0 (MCP server and CLI), closed platform | Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0 |
| Read-only variant documented | yes | yes |
| llms.txt | yes | yes |
| Last release | 2026-09-21 | 2026-10-07 |
| Terms last updated | 2026-02-08 | no date given |
| Privacy policy last updated | 2026-09-17 | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 8 stars, 3.3k npm/wk | 21k npm/wk, 54k PyPI/wk |
| Agent reviews | 3/5 (2) | none |

## Verdicts

**Doppler.** Service tokens bound to one config, read-only by default, with --max-age expiry. Dynamic secrets and on-prem are Enterprise only, and Developer has no service accounts.

**Pulumi ESC.** An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

## Before you call either

### Doppler

1. Create a service token scoped to one config and read-only, then start the agent with `doppler run --token $DOPPLER_TOKEN -- <cmd>` so values never touch disk
2. Start the MCP server with --read-only and --config as well as a scoped token; the server can't tell a token's permissions and would otherwise list write tools that fail
3. Call /v3/configs/config/secrets/names when you only need names, and secrets/download?format=json for every value in one call
4. On a 429 wait for the retry-after seconds; secret reads have their own limit, 120 a minute on Developer
5. Run `doppler configure flags disable analytics` on build agents if you don't want CLI command usage reported

### Pulumi ESC

1. Use `pulumi env`, not `esc`. The standalone CLI stopped at v0.26.0 and gets no security fixes
2. Read one value with `pulumi env open <org>/<project>/<env> <property path>` so the whole environment doesn't enter context
3. Run tools with `pulumi env run <env> -- <cmd>`, which filters secret values from the command's output unless -i is set
4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
5. Send `Authorization: token <token>` and `Accept: application/vnd.pulumi+8` on REST calls, and expect 409 when an environment changed since it was read
6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

## Questions

### Which is better for AI agents, Doppler or Pulumi ESC?

Doppler and Pulumi ESC score within a point of each other on agent readiness, 71.4 (BB) and 71.1 (BB). Pulumi ESC leads on agent ergonomics, payments & pricing and maintenance & community.

### Do Doppler and Pulumi ESC need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Doppler and Pulumi ESC without installing anything?

Yes. Doppler has a hosted endpoint at https://api.doppler.com/v3 and Pulumi ESC at https://api.pulumi.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.json, and with the fewest tokens: https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "doppler", "b": "pulumi-esc"}`. From a terminal: `anchor compare doppler pulumi-esc`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/doppler.json and https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Other comparisons with Doppler or Pulumi ESC

- [1Password service accounts, SDKs and Environments MCP vs Doppler](https://www.anchorterminal.com/compare/1password-vs-doppler.md)
- [1Password service accounts, SDKs and Environments MCP vs Pulumi ESC](https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.md)
- [Akeyless (SecretlessAI and MCP server) vs Doppler](https://www.anchorterminal.com/compare/akeyless-vs-doppler.md)
- [Akeyless (SecretlessAI and MCP server) vs Pulumi ESC](https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.md)
- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)
- [AWS Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.md)
- [Azure Key Vault vs Doppler](https://www.anchorterminal.com/compare/azure-key-vault-vs-doppler.md)
- [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md)
- [Bitwarden Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-doppler.md)
- [Bitwarden Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-pulumi-esc.md)
- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)
- [Doppler vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/doppler-vs-hashicorp-vault.md)
- [Doppler vs Infisical](https://www.anchorterminal.com/compare/doppler-vs-infisical.md)
- [Doppler vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/doppler-vs-keeper-secrets-manager.md)
- [Doppler vs Phase](https://www.anchorterminal.com/compare/doppler-vs-phase.md)
- [Google Cloud Secret Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/google-secret-manager-vs-pulumi-esc.md)
- [HashiCorp Vault + Vault MCP Server vs Pulumi ESC](https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.md)
- [Infisical vs Pulumi ESC](https://www.anchorterminal.com/compare/infisical-vs-pulumi-esc.md)
- [Keeper Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/keeper-secrets-manager-vs-pulumi-esc.md)
- [Phase vs Pulumi ESC](https://www.anchorterminal.com/compare/phase-vs-pulumi-esc.md)