# Per-service MITM request filter

**URL:** <https://community.infisical.com/t/per-service-mitm-request-filter/63>\
**Category:** Contributing\
**Created:** [October 2, 2026, 2:00pm UTC](https://community.infisical.com/t/per-service-mitm-request-filter/63 "2026-10-02T14:00:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucastheisen](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/lucastheisen/32/91_2.png) [@lucastheisen](https://community.infisical.com/u/lucastheisen)\
**Post date:** [October 2, 2026, 2:00pm UTC](https://community.infisical.com/t/per-service-mitm-request-filter/63/1 "2026-10-02T14:00:41Z")

</div>

I have need for more advanced filtering (than simple host/path) before attaching credentials. One specific need is to ensure a `git push` is not to a _protected branch_. In order to do so, i will have to read the initial portion of a git pack body, then make an API request to the git repo to determine if protected, then allow credentials. This type of complex workflow/logic is not something that can easily be abstracted inside a service like yours, so i put together a PR that injects a very minimal seam to had a request off to another proxy to do more complicated processing ([Implement filter proxy by lucastheisen · Pull Request #435 · Infisical/agent-vault · GitHub](https://github.com/Infisical/agent-vault/pull/435)). This way, your application can stay smaller and focused, but you can still allow downstream consumers to do what they need. I would appreciate a review when y’all have a chance.

---

<div class="post-metadata">

**Author:** ![ashwin-infisical](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/ashwin-infisical/32/34_2.png) [@ashwin-infisical](https://community.infisical.com/u/ashwin-infisical)\
**Post date:** [October 2, 2026, 4:44pm UTC](https://community.infisical.com/t/per-service-mitm-request-filter/63/2 "2026-10-02T16:44:31Z")

</div>

Hey Lucas! Thank you for your contribution!

I am passing this along to the Agent Vault team to review! We’re making a lot of updates to Agent Vault, so any insight into how you use it today is helpful!

---

<div class="post-metadata">

**Author:** ![lucastheisen](https://yyz2.discourse-cdn.com/flex048/user_avatar/community.infisical.com/lucastheisen/32/91_2.png) [@lucastheisen](https://community.infisical.com/u/lucastheisen)\
**Post date:** [October 2, 2026, 5:48pm UTC](https://community.infisical.com/t/per-service-mitm-request-filter/63/3 "2026-10-02T17:48:10Z")

</div>

This is my primary use case. A proxy between my agent and sensitive operations. I need a lot more control than just host/path. There is another PR that adds method to the builtin filter ([feat(broker): restrict services to specific HTTP methods by cjohnhanson · Pull Request #324 · Infisical/agent-vault · GitHub](https://github.com/Infisical/agent-vault/pull/324)). And i use that, plus my customization in this PR to provide this. In my environment, i run agent vault in a container next to a separate container where my agent lives. It is not run as a _shared_ service, but if you merge in my PR, then it _could_ be a shared service for the core agent vault, then each developer could simply define their own filter proxy and have the shared vault proxy the requests to the individual developers proxy.

Anyway, thats what i do.