create-environment
Create a new environment in Infisical
LABSCO SUMMARY
Standing up secrets for a new environment is one sequence of calls instead of a session in the dashboard.
The tool set is shaped around the coordinates Infisical uses: nothing resolves without projectId, environmentSlug and secretPath, and list-projects exists largely to find the first of those. What the identity can see is what you get, so scoping happens outside this server. The write side is complete for secrets and thin elsewhere — environments and folders can be created but not renamed or removed, and there is no tool to take back an invitation.
What it is
The official Infisical server: ten tools over secrets, projects, environments, folders and project membership, acting as a machine identity.
What you get
- Secrets created, read, updated and deleted at a secretPath inside a given projectId and environmentSlug
- Reads that resolve rather than echo: expandSecretReferences and includeImports turn a referenced or imported value into its actual content
- Projects created with a slug, type, description, projectTemplate and kmsKeyId, and listed by what the machine identity can reach
- Environments and folders created inside a project, so a new stage or path exists before anything is written to it
- Project invitations by emails or usernames, with the roleSlugs each invitee should get
Requirements
A machine identity's universal-auth pair, INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET, or an access token in INFISICAL_TOKEN with INFISICAL_AUTH_METHOD set to access-token. INFISICAL_HOST_URL is optional: it defaults to https://app.infisical.com and is only needed for a self-hosted or dedicated instance. Every secret call also needs a projectId, an environmentSlug and a secretPath. Apache-2.0 licensed.
Setup effort
One command plus credentials — npx -y @infisical/mcp, then supply credentials
USE CASES
01
Standing up a new environment for a service
Create the environment in the project, create the folder path the service reads from, then write its secrets at that path. Each step needs the coordinates of the last, so the order is not optional.
02
Rotating a credential that has leaked
Read the current value to confirm which secret is in use, write the replacement over it, and remove the old entry if it was kept under a separate name. Expanding references while reading shows the value consumers actually resolve.
03
Finding out what a machine identity can actually reach
List the projects the identity has access to, then list the secrets in the environment you care about with imports included, so inherited values show up rather than looking absent.
04
Bringing a new project and its people online
Create the project with the template and KMS key it should use, then invite the people who need it by email or username with the roles they get.
10 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
create-folder
Create a new folder in Infisical
create-project
Create a new project in Infisical
create-secret
Create a new secret in Infisical
delete-secret
Delete a secret in Infisical
get-secret
Get a secret in Infisical
invite-members-to-project
Invite members to a project in Infisical
list-projects
List all projects in Infisical that the machine identity has access to. If the user asks to list all projects, use the all type parameter.
list-secrets
List all secrets in a given Infisical project and environment
update-secret
Update a secret in Infisical
BEFORE YOU INSTALL
What to know first
Tools you get
10 tools when we connected. Tool names use hyphens. Seven of the ten write: they create, update and delete secrets, create projects, environments and folders, and invite people into a project.
Requires
- npx on PATH
- INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET (universal auth, the default) — or INFISICAL_TOKEN with INFISICAL_AUTH_METHOD set to access-token
CONTEXT COST
Light Standing cost
Rated by the size of the 10 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y @infisical/mcpMCP Clients
Claude Desktop — Universal Auth
CLAUDE DESKTOP — UNIVERSAL AUTH · JSON
{
"mcpServers": {
"infisical": {
"command": "npx",
"args": [
"-y",
"@infisical/mcp"
],
"env": {
"INFISICAL_HOST_URL": "https://<YOUR_CUSTOM_HOST_URL>.com",
"INFISICAL_UNIVERSAL_AUTH_CLIENT_ID": "<YOUR_INFISICAL_UNIVERSAL_AUTH_CLIENT_ID>",
"INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET": "<YOUR_INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET>"
}
}
}
}INFISICAL_HOST_URL is optional. On Infisical Cloud, delete that line (the default is https://app.infisical.com); keep it only for a self-hosted or dedicated instance, where <YOUR_CUSTOM_HOST_URL> is your own host.
Claude Desktop — token
CLAUDE DESKTOP — TOKEN · JSON
{
"mcpServers": {
"infisical": {
"command": "npx",
"args": [
"-y",
"@infisical/mcp"
],
"env": {
"INFISICAL_HOST_URL": "https://<YOUR_CUSTOM_HOST_URL>.com",
"INFISICAL_AUTH_METHOD": "access-token",
"INFISICAL_TOKEN": "<YOUR_INFISICAL_TOKEN>"
}
}
}
}INFISICAL_HOST_URL is optional. On Infisical Cloud, delete that line (the default is https://app.infisical.com); keep it only for a self-hosted or dedicated instance, where <YOUR_CUSTOM_HOST_URL> is your own host.
