OSS Local vault for every coding IDE

Your agent asked for Stripe.
You pasted the live key.

MetaVault keeps the key on this machine. The agent asks for a capability, a local model scores it, you approve, and the secret never enters the chat.

Download for Windows Read the docs View on GitHub
Apache-2.0 · No account · No telemetry
01 // The request
The agent asks. You answer. Explore
openvault / mcp
Five tools
One snippet, any IDE Explore
Gates 5 steps
Policy, then you Explore
02 // What leaks Zero keys
Pasted into the chat
The key sits in the transcript, the tool log, and tomorrow's rotation.
Something to steal
Asked as a capability
The agent receives the tool result. The key stayed inside vaultd for that one call.
Nothing to leak
The secret is not a message Explore
03 // The floor Fail closed
A write under a read ceiling dies first

Policy denies it before the model is asked. The warden can narrow a scope or force you to look. It cannot widen one, and it never sees the key.

Secure with the model off Explore
04 // Interactive preview

A request, from the paste to the result.

Pick a step. The buttons are a simulation. Nothing is stored, and no key is real.

openvault / approval
Request path
Simulation Local only

Store the key once

You type it in the app. The field clears. The agent learns the alias and the ceiling, never the value.

Open source, not a plan

The license is the price.

Apache-2.0. The vault, the warden, the MCP server, and the audit log ship together. There is no tier to upgrade into.

The license Apache-2.0
$0 / forever

Fork it, read it, run it without an account.

  • — Vault, warden, MCP, and the desktop app
  • — No account and no telemetry
  • — Keys encrypted at rest, master key in the OS keychain
  • — The canary test fails the build if a secret leaks
  • — Docs, architecture, and the research report are in the repo
Read the license
Your machine Windows first
Local / 127.0.0.1

The daemon binds to localhost. The warden defaults to a model you run.

  • — Windows installer, or build from the source
  • — Default warden llama3.2:3b through Ollama
  • — Larger local models, or an opt-in Meta API model
  • — Human approval stays in the app. An agent that tries to approve itself gets 401
  • — Air-gap is a packaging choice. The vault already refuses every other network
Download for Windows
Get the vault

Download it. Point an IDE at it.

Download for Windows View source IDE setup 
{
  "mcpServers": {
    "openvault": {
      "command": "node",
      "args": ["<openvault>/dist/packages/mcp/src/server.js"],
      "env": { "OPENVAULT_AGENT_ID": "cursor", "OPENVAULT_IDE": "Cursor" }
    }
  }
}