Security
Infisical MCP connector
The Infisical connector brings your app connections, machine identity auth methods, and admin setup into Claude, ChatGPT, Cursor, and any MCP client, so your team can ask about and manage Infisical in plain language.
-
How it connects. Connects with an API key. The credential goes into a vault nobody reads back.
-
One address. https://api.elaichi.ai/mcp, the same for every user.
-
Their own access. An agent never gets more than the person it acts for.
352 tools
How to connect
How to connect Infisical to Claude, ChatGPT or Cursor
Two steps, about a minute.
In Elaichi
Connect Infisical once
-
Open Connections, choose Add connection, and pick Infisical.
-
Optionally set Share with to give a team access, then press Connect.
-
Paste an Infisical API key. One person generates a token in Infisical and pastes it once. Everyone else works through Share with, and never sees it.
The credential is vaulted. Nobody reads it back, not even the AI.
Add connection
Choose a connector.
In your AI client
Point it at one endpoint
Everyone in the organization uses the same address, and each person only ever reaches what their own account allows.
Connect Infisical to Claude
-
1
Open Customize, then Connectors.
-
2
Press Add.
-
3
Name it, paste the MCP server URL, then Continue.
https://api.elaichi.ai/mcp -
4
Sign in and approve.
On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.
Connect Infisical to ChatGPT
-
1
Open Plugins, then press the + button.
-
2
Name it and paste the endpoint into Server URL.
https://api.elaichi.ai/mcp -
3
Leave Authentication on OAuth, then tick the risk acknowledgement.
-
4
Press Create, then sign in and approve.
Works on the web today. The plugin directory lives at chatgpt.com/plugins.
Connect Infisical to Cursor
-
1
Open
~/.cursor/mcp.json. -
2
Add the endpoint under
mcpServers.https://api.elaichi.ai/mcp -
3
Reload Cursor, then sign in and approve.
~/.cursor/mcp.json
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
Set up per machine, so repeat it on each computer you work from.
Connect Infisical to any MCP client
-
1
Add the endpoint as a remote MCP server.
https://api.elaichi.ai/mcp -
2
Sign in and approve.
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
The Elaichi Agent already has these tools, with nothing to set up.
Use cases
What teams do with Infisical through Elaichi
Every one of these runs inside the access the person already has, and lands in the same audit log.
-
Security
Review every app connection in one pass
Ask for a list of the 1Password, Auth0, and AWS app connections in Infisical, who they belong to, and which ones look unused, without clicking through each one.
-
Platform engineering
Set up a new cloud connection after onboarding
When a new AWS account comes online, create its app connection in Infisical by name and confirm it shows up alongside the existing ones.
-
DevOps
Attach machine identity auth to a workload
Attach Alibaba Cloud auth to a machine identity in Infisical so a pipeline can log in on its own, then check the settings by ID before the first deploy.
-
IT
Revoke access when a service is retired
Revoke a machine identity's auth method in Infisical and delete the app connections a decommissioned tool relied on, so nothing keeps working that should not.
-
Compliance
Answer an auditor's question about connections
Pull the details of a single Auth0 or 1Password app connection in Infisical by name and hand back a plain summary of what it connects and when it changed.
-
Engineering
Bootstrap a fresh Infisical instance
Run the admin bootstrap for a new self-hosted Infisical instance and confirm the first app connections are in place before the rest of the team signs in.
Try asking
- “List app connections created in Infisical this month.”
- “Which machine identities can read the production project?”
- “Summarize secrets changed across staging projects this week.”
AI tools
Infisical tools for your AI agents
352 tools are ready to call through Elaichi's MCP endpoint the moment you connect Infisical, governed by the same roles, restrictions, and audit log as everything else in Elaichi.
No tools match your search.
See it in Elaichi
What connecting Infisical gets you
6 screens from the product, each doing one job for your Infisical account.
The agent
Ask about Infisical secrets in plain language.
Questions about app connections and identities get answered from live Infisical records.
- secrets
- projects
- app connections
- machine identities
Ask Elaichi to work across your apps.
List app connections created in Infisical this month.
Which machine identities can read the production project?
Summarize secrets changed across staging projects this week.
Also runs in Claude, ChatGPT or Cursor
MCP clients
Claude, ChatGPT and Cursor reach Infisical here.
One org MCP endpoint over OAuth, no SDK and no shared API key.
ElaichiMCP clientsClaude
ChatGPT
Cursor
Copy the endpoint
Tool catalog
352 Infisical tools are ready to call.
Secrets, projects, app connections and machine identities covered without custom code.
- Infisical admin bootstrap instance
- Infisical alicloud auth attach
- Infisical alicloud auth login
- Infisical alicloud auth revoke
ElaichiToolsToolboxes
Every team gets its own Infisical toolbox.
Platform, security and app teams each work from a toolbox scoped to them.
- Platform
- Security
- Application engineering
- SRE
ElaichiToolboxesShared connections
Teammates use Infisical without seeing a token.
Each connection shows who added it and which teams and members share it.
- Production
- Staging
- Security engineering
- Data platform
ElaichiConnectionsAudit log
Every Infisical call is written down.
When, who, what happened, type and resource for each secret and identity touched.
- When
- Who
- What happened
- Type
ElaichiAudit logLaunching soon
From answering questions to doing the work
A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards are launching soon, on the Black plan.
Automations
A schedule drives Infisical work end to end.
Six steps fetch secrets, group them, draft a digest, take approval, post back.
Infisical digest
Run 418 · started 2 minutes ago · on behalf of Emma Laurent
-
✓
Schedule
Every weekday at 08:00
0.2s -
✓
Fetch secrets
Infisical
1.4s -
✓
Group by owner
Transform
0.1s -
✓
Draft the digest
Agent step
Ran with 4 tools, returned a structured summary
6.2s -
Approve the digest
Needs approval
Assigned to Michael Brennan
Approve Deny -
Post the digest
Infisical
Queued
Collections and dashboards
Infisical health arrives before anyone asks.
Four metrics, 14 days of secrets created and a team breakdown, refreshed on schedule.
Infisical health
Refreshed 4 minutes ago · every 15 minutes · from the secrets collection
Secrets
1,284 ↓ 12%
Projects
96 ↓ 8%
Needs attention
3 ↑ 2
Updated this week
412 ↑ 9%
Secrets created
Last 14 days
By team
Share of activity
Production 34%
Staging 27%
Security engineering 21%
Data platform 18%
Related connectors
More from the catalog
FAQ
Frequently asked questions
How do I connect Infisical to Claude?
Connect Infisical in Elaichi first, which asks you to paste an Infisical API key and nothing else. There is no OAuth application to register and no client ID or secret to generate. Then in Claude go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp. Sign in to Elaichi when Claude asks and Infisical is ready to use.
Does Infisical work with ChatGPT and Cursor as well as Claude?
Yes. Once Infisical is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Infisical once and every client picks it up.
What can an AI agent actually do with my Infisical data?
With Infisical connected, an agent can list your app connections to services like AWS, 1Password, and Auth0, look one up by name or ID, create or update one, and remove one you no longer need. It can also attach, update, or revoke cloud auth methods on machine identities and run the admin bootstrap for a new instance. Because Infisical exposes several hundred actions, short, specific asks such as "list the AWS app connections" get better results than long paragraphs.
Does connecting Infisical give the AI everything in my organization?
No. Every call to Infisical runs with the access of the API key you connected and the Elaichi account of the person making the request, so the agent sees only what that key can already see in Infisical. Elaichi can narrow that further with restrictions, and it never widens access beyond what Infisical itself allows.
Can I stop an agent from deleting or changing things in Infisical?
Yes. Restrictions in Elaichi apply per action, so you can allow reading Infisical app connections while blocking deletion or revocation. A blocked action is never advertised to Claude, ChatGPT, Cursor, or any other client, so no prompt can reach it, no matter how it is worded.
What happens to an Infisical connection when someone leaves?
Offboarding the person in Elaichi ends their access to Infisical through every client at once. A shared Infisical connection keeps working for everyone else on the team. If you want to remove Infisical entirely, disconnecting it once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client at the same time.
Put Infisical in front of your team
Fourteen days on Gold, no credit card. Connect it once and pick what each team can call.