Documentation

Install (Windows first)

Download the Windows installer from the releases page, or build from source:

git clone https://github.com/0xm0w/openvault
cd openvault
npm install
npm test   # 146 tests

You also need Ollama for the local warden. OpenVault runs entirely on your machine; there is no account and no telemetry.

First run

openvault init
openvault model pull        # detects your GPU, pulls llama3.2:3b (~2 GB on 8 GB cards)
openvault add stripe --scope charges.read

init creates the encrypted vault (AES-256-GCM; master key in Windows Credential Manager). add reads the secret from a hidden prompt and never echoes it. Aliases and scope ceilings are all any agent will ever learn.

Connect your IDE (one MCP snippet)

Every MCP-capable IDE or agent uses the same snippet. This is the only per-IDE step:

{
  "mcpServers": {
    "openvault": {
      "command": "node",
      "args": ["<openvault>/dist/packages/mcp/src/server.js"],
      "env": { "OPENVAULT_AGENT_ID": "cursor", "OPENVAULT_IDE": "Cursor" }
    }
  }
}

Tools exposed: request_capability, list_aliases (aliases + ceilings only), revoke. There is deliberately no approve tool — approval belongs to the human, in the app. An agent that tries to approve its own request over the daemon HTTP API gets a 401; those routes require the daemon token, which only the app and CLI hold.

CLI

openvault add <alias> --scope <scope>   # enrol a credential (hidden prompt)
openvault approve <grantId>              # approve a pending request
openvault audit                            # request log with marshal decisions
openvault revoke <agent-or-alias>        # kill pending + future grants
openvault model pull                       # fetch/upgrade the warden model

LLM Security Levels

The vault is secure at every level — deterministic policy ceilings, single-use expiring grants, and human approval cannot be overridden by any model. Higher levels buy judgement, not permission:

• STANDARD (Low) — no model. Policy only. Everything sensitive asks you.
• GUARDED (Medium) — Llama 3.2 3B Q4 on-device (default; runs well on an 8 GB GPU). Risk labels, scope recommendations, explanations.
• FORTIFIED (High) — Muse Glimmer 30B on-device (24 GB-class GPU). Pattern-spotting across request history; stronger injection resistance.
• MAXIMUM — Muse Spark / Muse Wonder via the Meta Model API. Frontier reasoning over request metadata. Opt-in; metadata only, never keys.

Measured on the reference machine: live marshal call ~1.9 s warm; eval safety 100% at every level (see Architecture).

Tripwires (auto-revocation)

• After use — every grant is single-purpose and expires the moment the call completes.
• After TTL — pending approvals die in 60 seconds by default; standing approvals can carry their own TTL.
• After event — one click (or one CLI command, or one MCP revoke) cancels pending grants and blocks all future ones for that agent or credential, effective immediately.

Request Logs

The Audit view (and openvault audit) shows the full timeline per request: agent → scope → marshal assessment (model named) → policy → your decision → executed/expired/revoked. If it happened, it is in the log; if it is in the log, it contains no secret — the canary test enforces that in CI.

Policies

Per-alias ceilings cap what any agent can ever receive (e.g. stripe → charges.read). A requested write under a read ceiling is denied outright. "Always allow" creates a standing approval only for read-only, warden-rated low-risk scopes; writes ask every time. Standing approvals live in daemon memory and clear on restart — fail-safe by design.

Open source readiness

Apache-2.0. 146 automated tests, strict TypeScript, lint-gated Effect discipline in the daemon core, a canary secrecy test that fails the build on any leak, and public CONTRIBUTING.md / SECURITY.md in the repo. macOS packaging is parked; Windows is the supported platform today.