Not a feature checklist. This compares the security architecture of the secret managers built for AI coding agents: where your secrets live, and who — or what — can read them. Every claim below is drawn from public documentation or source, and linked.
| OpaqueVault | Infisical | Phase | Doppler | |
|---|---|---|---|---|
| Server can decrypt your secrets? | No | Yes | Yes¹ | Yes |
| Returns secret values to the AI over MCP? | No | Yes | No MCP | Yes |
| MCP server for coding agents? | Yes | Yes | No | Yes |
| Post-quantum transport? | Yes | No² | No² | No² |
¹ Phase: when server-side rendering (SSE) is enabled — required for its public API, integrations, rotation, and dynamic secrets. With SSE off, Phase is genuinely end-to-end encrypted.
² No post-quantum hybrid transport documented publicly by these agent-native secret managers as of August 2026.
1Password matches OpaqueVault on this security axis — it is zero-knowledge, its Environments MCP server returns variable names only, and it shipped hybrid post-quantum key exchange for its apps in 2026. It is left out of the table above because it is a closed-source password manager oriented around human vaults, not an agent-native developer tool — a different category. If you want an end-to-end encrypted vault and live in 1Password already, it is a strong choice. This page compares the secret managers built first for AI coding agents.
This is deliberately narrow. Infisical, Phase, and Doppler each have real strengths beyond this table — breadth of integrations, dynamic secrets, mature dashboards. The table answers one question: on keeping secrets away from both the server and the AI model, where does each land? OpaqueVault is the only column here that answers favorably to every row — and it treats "the server can never decrypt" as a fixed invariant, not a mode you can leave on or off.
Which MCP secret servers return plaintext values to the model — Infisical's does by default, and so does Doppler's. Verified against public source. →
Phase's E2EE is real — until you turn on a feature that needs the server to decrypt. Checked against Phase's public source. →
A secrets manager is zero-knowledge only if its server cannot decrypt your values under any feature. Among secret managers built for AI coding agents, OpaqueVault meets that bar — the server holds no key that can decrypt. Infisical and Doppler decrypt server-side, and Phase can decrypt whenever server-side rendering is enabled (which its API, integrations, rotation, and dynamic secrets require). 1Password also meets the zero-knowledge bar, but it is a closed password manager rather than an agent-native developer tool.
OpaqueVault has no tool that returns a secret value to the model. Infisical's official MCP server returns plaintext secret values by default, and Doppler's MCP can read secret values by default. Phase ships no MCP server at all, so it has no agent story on this axis.
No. As of its public source, Phase ships no Model Context Protocol server in any of its repositories; agent access is via its CLI plus a skill document.
OpaqueVault uses an ML-KEM-768 + X25519 hybrid for transport, resisting "harvest-now, decrypt-later" attacks. Among the agent-native secret managers, no post-quantum hybrid transport is documented by Infisical, Phase, or Doppler as of August 2026. (Some general-purpose vaults, such as 1Password and AWS Secrets Manager, have announced post-quantum TLS for their own surfaces.)
Zero-knowledge. No plaintext to the AI. Quantum-safe.
Free to start.