Meta Global AI Developer Hackathon · Indie Track

Tired of pasting API keys into all your coding IDEs?

So is every developer on Earth. We did it this morning. The key is in a transcript now. Forever.

Problem

Your keys are stored inside your tools. When a tool leaks, you wake up to a $4,000 bill.

It keeps happening: credentials sitting in dev tools get exfiltrated and burned by bots within hours. Tired of rotating keys because you pasted one? Tired of manually revoking? Tired of trusting cloud password managers with your agent's hands?

Solution

One vault for all your keys. Meta LLMs guard it from the requestors.

OpenVault puts every credential in one local, encrypted vault. Agents in Cursor, Claude Code, Codex, and VS Code request scoped capabilities over MCP. A Meta LLM warden assesses each requestor. You approve once. The key is injected inside the daemon and never enters a chat, a prompt, or a model.

Security

A dumb vault. A smart warden. A tripwire on every grant.

The vault

Deliberately dumb

AES-256-GCM at rest, OS-keychain master key, hard policy ceilings, single-use grants. Secure with no AI at all.

The warden

Meta LLMs on guard

Llama 3.2 3B locally today; Muse Glimmer 30B; Muse Spark and Wonder at maximum. Wardens see metadata only — never plaintext keys. A stronger warden detects attacks from rogue agents mid-flight.

The tripwire

Auto-revocation

Grants die after use, after TTL, after events, or on one click — mid-task. Manual revocation is over.

Why Meta models are load-bearing

The warden makes access decisions, not chat replies.

Every request is risk-scored by a Meta model with a published, measured eval: 17 attack scenarios — disguised writes, scope escalation, prompt injection, bursts. Live Llama 3.2 3B on an 8 GB GPU: safety 100%. Its risk labels are weak (23.5%) and we publish that too — because deterministic policy holds the floor either way. OpenVault is secure even if the AI is wrong, and measurably safer when it's smart.

Proof, not promises

146tests passing, strict TS + lint gated
7/7live rehearsal checks in 3.6 s
17canary-scanned surfaces, zero leaks
3real bugs caught by our own gates (and fixed)

Built by the team behind Keythings Wallet. Same discipline as a crypto wallet — except the payloads are API requests, and they are far more complex than signatures. Roadmap: air-gapped vaults, secure enclaves, hardened devices.

The new standard

NEVER LEAK YOUR KEYS ANYMORE. This is the new standard.

Download for Windows Open source — Apache-2.0 keythings.xyz

The future is secure, easy, and has infinite possibilities.