Porticol vs agent-access products

Postman Passport, Keycard, Infisical Agent Vault and Bruno's MCP server each help a coding agent reach an API. None is an API client. This page sets out what each does, where it is stronger, and what Porticol adds.

What Porticol does differently

It approves one exact call. A person sees the request and allows that request alone, once, for 10 minutes.
It starts on your computer. The desktop app and the CLI hold the policy and inject the keys; a team can add a gateway on its own server for production.
It is priced per seat. Free for one person, $9 a seat a month for Team and $19 for Business. See pricing.

At a glance

	Porticol Checked 9 Nov 2026	Postman Passport Checked 9 Nov 2026	Keycard Checked 9 Nov 2026	Infisical Agent Vault Checked 9 Nov 2026	Bruno's MCP server Checked 9 Nov 2026
Keeps keys away from the agent	Yes. MCP never passes key values to the agent; the local proxy injects them.⁸	Yes. A caller holds a credential reference, and the proxy in your network resolves the real key.¹	Partly. Coding agents get short-lived credentials as environment variables; only its MCP gateway keeps the token from the agent.⁴	Yes. A forward proxy injects the key, and the agent never sees it.⁶	Partly. It masks known credential headers and secret variables, but other headers and bodies come back as they are.⁷
Approves one exact call	Yes. An approval is bound to a hash of the exact request, single use, 10 minutes.⁸	No. An admin approves access to an API; no one approves a single call.⁹	No. Calls are allowed or denied by policy, with a one-time sign-in or consent; no person approves a single call.⁴	No. Firewall rules for requests are planned; a person cannot approve a single call.⁶	No. A request runs when the agent asks; no person approves the call.⁷
Records every agent call	Yes. A hash-chained log records every agent call.⁸	Yes. Every request is logged against the caller's identity.⁹	Yes. Every action is recorded as telemetry with its identity; 7 days on Starter and 90 on Team.⁵	Yes. It logs each proxied request; bodies and query strings are not recorded.⁶	No. It returns a run's results to the agent and keeps no log of its own.⁷
Runs on your computer	Yes. Desktop app and CLI; the team gateway on your server.⁸	No. A local daemon sends requests to the proxy in your cloud.⁹	No. Policy and credentials are handled in Keycard's cloud; running it in your own cloud is listed as coming soon.⁵	Partly. You run its proxy on your own servers, and it needs an Infisical Cloud organisation or a self-hosted Infisical.⁶	Yes. The server runs on your computer over the collections on disk.⁷
Price for a small team	$9 a seat a month (Team), $19 (Business); Free for one person¹⁰	Not published: contact sales¹¹	$0 up to 5,000 transactions a month; Team $500 a month for 100,000 transactions⁵	In preview: the first 5,000 requests a month are free on the Pro plan, then $2 per 1,000¹²	Free⁷

Every fact about another product comes from its own pages, checked on 9 Nov 2026. The numbers link to the sources at the end.

Where they are stronger

Postman Passport

Postman's secret-free access product, with a proxy that runs in your network.

It resolves credentials from your own vault inside a proxy in your network.¹
It scopes access to an exact endpoint and checks the caller on every request.²
An agent gets a short-lived identity, and agents it starts inherit only part of its access.³

Keycard

An access control plane for agents, with policy, sign-in consent and telemetry.

It gives each agent short-lived credentials scoped to its task.⁴
It is free up to 5,000 transactions a month.⁵
Its policy can combine roles, attributes and relationships across agents and people.⁵

Infisical Agent Vault

A credential proxy that injects keys into an agent's HTTP traffic, in preview.

It keeps keys out of the agent by injecting them at a proxy it runs beside.⁶
It works below the interface, so curl, SDKs, MCP clients and scripts all go through it.⁶
It logs every proxied request with its method, endpoint, status and latency.⁶

Bruno's MCP server

A local MCP server that lets an agent read and run Bruno collections.

It is free and open source under the MIT licence.⁷
It works from the collection folder Bruno already uses, with no import.⁷
It masks known credential headers and secret variables before a result reaches the agent.⁷

Try Porticol free

Free for one person on macOS, Windows and Linux. Add a coding agent over MCP in one command.

Download free See pricing