OSS By Keythings · Securing Keys Since 2025

Your agent asked for Stripe.
You pasted the live key.

MetaVault keeps the key on this machine. The agent asks for a capability, a local model scores it, you approve, and the secret never enters the chat.

Download for Windows Read the docs View on GitHub
Apache-2.0 · No account · No telemetry · From former crypto wallet bug bounty hunters
01 // The request
The agent asks. You answer. Explore
openvault / mcp
Five tools
One snippet, any IDE Explore
Gates 5 steps
Policy, then you Explore
02 // What leaks Zero keys
Pasted into the chat
The key sits in the transcript, the tool log, and tomorrow's rotation.
Something to steal
Asked as a capability
The agent receives the tool result. The key stayed inside vaultd for that one call.
Nothing to leak
The secret is not a message Explore
03 // The floor Fail closed
A write under a read ceiling dies first

Policy denies it before the model is asked. The warden can narrow a scope or force you to look. It cannot widen one, and it never sees the key.

Secure with the model off Explore
04 // Interactive preview

A request, from the paste to the result.

Pick a step. The buttons are a simulation. Nothing is stored, and no key is real.

openvault / approval
Request path
Simulation Local only

Store the key once

You type it in the app. The field clears. The agent learns the alias and the ceiling, never the value.

Open source, not a plan

The license is the price.

Apache-2.0. The vault, the warden, the MCP server, and the audit log ship together. There is no tier to upgrade into.

The license Apache-2.0
$0 / forever

Fork it, read it, run it without an account.

  • — Vault, warden, MCP, and the desktop app
  • — No account and no telemetry
  • — Keys encrypted at rest, master key in the OS keychain
  • — The canary test fails the build if a secret leaks
  • — Docs, architecture, and the research report are in the repo
Read the license
Your machine Windows first
Local / 127.0.0.1

The daemon binds to localhost. The warden defaults to a model you run.

  • — Windows installer, or build from the source
  • — Default warden llama3.2:3b through Ollama
  • — Larger local models, or an opt-in Meta API model
  • — Human approval stays in the app. An agent that tries to approve itself gets 401
  • — Air-gap is a packaging choice. The vault already refuses every other network
Download for Windows
05 // Real GitHub Timeline

From Wallet Security to Agentic Vaults

Verified shipping milestones across our repositories since 2025.

2025 · Pre-fable & Pre-opus 5 era Production Verified

Crypto Wallet Security Audits & Keeta Wallet OSS

Work history in crypto wallet bug bounty hunting and protocol vulnerability research. Engineered and maintained Keeta Wallet OSS for Keeta Network — securing daily non-custodial transactions in production with 0 security incidents.

2026-10-31 · Genesis MVP Genesis

OpenVault MVP: Local Llama Marshal & 5-Tool MCP

Architected the local AES-256-GCM vault daemon (vaultd), deterministic policy ceiling, Model Context Protocol server, secret canary test sweep, and Electron approval shell.

2026-11-01 · Public Release v0.1.0 Released

MetaVault OSS Rebrand & In-App WebGPU Built-in AI

Shipped Windows installer, multi-host IDE support (Cursor, Claude Code, VS Code, Codex), WebGPU ONNX in-app AI engine, and OWASP LLM Top 10 empirical verification benchmark.

2026-11-02 · Current Sprint Active Hackathon Sprint

Meta Hackathon Kickoff & Live Defense Hardening

Launched the Meta Hackathon (Indie track) interactive pitch deck at metahackathon.whativedone.xyz. Hardened adversarial prompt defenses, caller process quarantine, and empirical 100% defense against live Llama 3.2 3B.

Get the vault

Download it. Point an IDE at it.

Download for Windows View source IDE setup 
{
  "mcpServers": {
    "openvault": {
      "command": "node",
      "args": ["<openvault>/dist/packages/mcp/src/server.js"],
      "env": { "OPENVAULT_AGENT_ID": "cursor", "OPENVAULT_IDE": "Cursor" }
    }
  }
}