{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-TOOL-TRUST-INFISICAL-01-v1",
  "record_kind": "external_reference",
  "title": "Infisical MCP: Tool restrictions and secret-value masking",
  "system": "Infisical",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does a read-only Infisical tool list keep secret values out of model context?",
  "near_questions": [
    "Can read-only secret tools reveal secret values?",
    "Is Infisical value masking enabled by default?",
    "What remains visible when secret values are masked?",
    "Does hiding a tool also reject direct calls to it?",
    "Which identity scopes restrict a secrets assistant?",
    "Can the Infisical connector invite project members?",
    "Does a custom host change where secret requests go?",
    "What should a metadata-only secret review verify?",
    "Can a broad token outlive a narrow tool configuration?",
    "Which control prevents unwanted secret writes?",
    "When should unmasked secret retrieval need clarification?",
    "Can I save a secret-exposure decision?"
  ],
  "supported_claims": [
    {
      "claim": "Read tools can return values. The README documents a separate masking option that defaults off and still returns metadata when enabled. A tool allowlist limits exposed operations, while identity scope limits underlying access. Review all three before claiming that the connector hides secrets.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Read tools can return values. The README documents a separate masking option that defaults off and still returns metadata when enabled. A tool allowlist limits exposed operations, while identity scope limits underlying access. Review all three before claiming that the connector hides secrets.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-VAULT-01-v1",
    "VXI-EXT-TOOL-TRUST-AUTH0-01-v1",
    "VXI-EXT-TOOL-TRUST-BITWARDEN-01-v1",
    "VXI-EXT-TOOL-TRUST-DOPPLER-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Infisical MCP secret operations",
    "source_url": "https://github.com/Infisical/infisical-mcp-server/blob/main/README.md",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-INFISICAL-01-v1",
    "candidate_record_sha256": "e9d548872aa36535654be2555833f3445d48dc4589dd84a37e60e3625397d9b4",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Read tools can return values. The README documents a separate masking option that defaults off and still returns metadata when enabled. A tool allowlist limits exposed operations, while identity scope limits underlying access. Review all three before claiming that the connector hides secrets.",
    "required_buyer_context": "Machine identity or token, project scope, tool allowlist, masking option and target host.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Infisical",
      "variant": "Official local Infisical MCP"
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Infisical publishes the MCP server.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Secret and project operations through Infisical APIs.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Secret values and metadata, unless values are masked.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Secret changes, project setup and member invitations.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "Machine universal authentication or a personal/machine access token.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Optional tool allowlist and value masking complement identity scope.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Secret metadata remains visible even with value masking.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Read-only tools can disclose values when masking is unset.",
        "source_ids": [
          "infisical"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Buyer identity scope and selected host are unverified.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Require explicit value-handling approval before unmasked secret reads.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "infisical",
        "url": "https://github.com/Infisical/infisical-mcp-server/blob/main/README.md",
        "final_url": "https://github.com/Infisical/infisical-mcp-server/blob/main/README.md",
        "title": "Infisical MCP secret operations",
        "checked_on": "2026-10-14",
        "sha256": "3ec472d8c091b729c023b6d41c3060ddaa37e107ea0cd044330838ba12eaa64e",
        "bytes": 266802
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Preserve which control limits operations, which limits identity scope and which masks returned values.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Masking defaults, allowlist enforcement and new secret tools."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-14",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#infisical-mcp-value-mask-tool-trust",
  "machine_readable_record": "/varexis-index/records/infisical-mcp-value-mask-tool-trust.json"
}