Docs

Point an IDE at the vault. Leave the key here.

Windows first. One MCP snippet. You approve. The agent receives a result, never the secret.

01

Install

Windows

The installer

No account. No telemetry. The vault stays on this machine.

Download for Windows
From source

Clone and build

git clone https://github.com/0xm0w/openvault
cd openvault
npm install
npx tsc -p tsconfig.json --outDir dist
Local model

Ollama, if you want a warden

The vault is already safe with the model off. Edge acceleration adds judgement. Default model: Llama 3.2 1B (Edge / WebGPU DirectML), about 1.3 GB.

Get Ollama
02

Three commands, then the app

1 · init

Create the vault

AES-256-GCM. The master key goes to the OS keychain, not a file you can paste.

2 · model pull

Optional warden

Detects the GPU and loads Llama 3.2 1B (Edge / WebGPU DirectML). Skip this and policy still holds the ceiling.

3 · add

Store a secret once

openvault add stripe --scope charges.read reads a hidden prompt. The agent learns the alias and the ceiling.

03 · MCP

One snippet per IDE

Replace <openvault> with your checkout. The agent id is how audit and revoke find that IDE. Full host notes live in docs/MCP.md.

{
  "mcpServers": {
    "openvault": {
      "command": "node",
      "args": ["<openvault>/dist/packages/mcp/src/server.js"],
      "env": {
        "OPENVAULT_AGENT_ID": "cursor",
        "OPENVAULT_IDE": "Cursor"
      }
    }
  }
}
request_capability list_aliases request_enrollment enrollment_status revoke

Five tools. There is no approve tool. An agent that calls the approve route itself gets 401.

04

What you see in the app

Real screenshots. The credential in them is a test value.

Add credential modal, prefilled alias and scope, secret field empty
The agent asks to enroll. You type the secret. The field does not come back.
05 · Warden

A stronger model is not a stronger permission.

Policy only

None

Ceilings, expiry, and your approval. Works with the model switched off.

Edge · default

Llama 3.2 1B

Edge / WebGPU DirectML on this machine. Risk, a recommended scope, one line of why.

High

llama3.1:8b

Same metadata. Stronger judgement. Still no key in the prompt.

Maximum-local

llama3.3:70b

A large local GPU. Nothing about the request leaves the machine.

Opt-in

Meta API

Metadata only, to the API you configure. The key stays in the daemon.

Opt-in

Meta BFT

Byzantine fault-tolerant consensus: Meta API (cloud) plus on-device Llama co-audit. Cross-verification with offline fallback.

Effort is separate: Fast, Standard, or Deep. Deep runs two passes; if they disagree it keeps the narrower scope, raises risk to the higher of the two, and requires your approval. Why the floor holds is on the research page.

06

Every grant dies

After use

One call

The grant expires when that call returns.

After TTL

60 seconds

A pending approval that you ignore is gone.

On revoke

One click

App, CLI, or the MCP revoke tool. Pending and future grants for that agent stop.

07

The log shows the decision, not the key

Always logged

Who asked, which IDE, the scope, the warden line, your decision, execution, expiry, revocation.

Never logged

No key, fragment, or hash. Same ban on MCP responses and the settings screen. The check is the 27-surface canary.

08 · Policy floor

The ceiling is the law

stripe → charges.read means a write never runs, even if a model recommends it. Always-allow is only for a low, read-only repeat. Those standing approvals live in memory and clear on restart.

Apache-2.0. Windows is the supported platform today. macOS packaging is parked.