Architecture

A dumb vault. A warden that never sees the key.

The layer that holds secrets does not talk to agents. The layer that talks to agents does not hold secrets.

Three layers

Who is allowed to know what

App

Approval, vault, logs, policies

Plain TypeScript in Electron. It shows you the decision. It does not keep the secret.

vaultd

The dumb vault

AES-256-GCM, OS keychain, the policy floor, single-use grants, and the one place a key is decrypted.

Edges

Agents and the warden

IDEs speak MCP. The warden scores metadata. Neither side receives the key.

One request

Denied early, or returned without a key

sequenceDiagram
  participant Agent
  participant Policy
  participant Warden
  participant You
  participant Vault
  Agent->>Policy: request_capability
  alt Write under a read ceiling
    Policy-->>Agent: denied, model never called
  else Inside the ceiling
    Policy->>Warden: agent, alias, scope, reason
    Warden-->>You: risk, and a scope it cannot widen
    You->>Vault: approve once
    Vault-->>Agent: the tool result, key absent
  end

A self-approve hits 401. MCP has no approve tool. The daemon token stays in the app and the CLI.

The floor

These do not depend on the model

No secret in the transcript

MCP, HTTP, logs, the UI, and the model prompt. A canary covers 27 surfaces and fails the build on a hit.

Plaintext has one room

Inside vaultd, for that one connector call.

Narrow, never widen

The warden can shrink a scope. It cannot step past the alias ceiling.

Grants expire

After the call, after the TTL, or the moment you revoke.

Localhost only

The daemon does not listen on the network. Human routes want the daemon token.

Model down is still safe

Fooled, malformed, or missing: policy and you decide. The floor does not move.

Meta models

Judgement on top of the law

The shipped catalogue is what Settings exposes. A larger model is better at spotting a write phrased as a read. It is not a wider permission.

none Llama 3.2 1B (Edge / WebGPU DirectML) · default llama3.2:3b llama3.1:8b llama3.3:70b Meta API · opt-in
Like a wallet

Keys are used, not shown

Encrypted at rest. A human approves. The secret is not a field you can copy back out.

Unlike a signature

The payload is an API call

Who asked, which scope, what they claimed, and what the warden thinks. That context is the product.

Next

Air-gap is a package, not a rewrite

Air-gapped vault

No network path at all. The vault is already isolated from everything except localhost.

Enclave and device

The same daemon boundary, on hardened hardware.

Browser approval

The same human decision, outside the desktop app.

Team policy packs

Ceilings you share. The floor still cannot be widened by a model.

The measured write-up, including the ceiling probes and the canary, is the research page.