Open source · Local-first · Windows
Put all your keys in one vault. Let Meta LLMs guard it from the requestors. OpenVault is the wallet for agents: Cursor, Claude Code, Codex and VS Code ask for a scoped capability, a local Meta model vets the request, you approve — and the key itself is never shown to the agent, the chat, or the model.
The problem
Three failure modes, one root cause: the key was somewhere it never needed to be. In a transcript. In a tool's storage. In someone else's cloud.
Every paste into a chatbox, an IDE prompt, or a support ticket is a future 2 a.m. rotation. Transcripts persist. Context windows get logged. The key outlives the conversation.
It has happened to teams again and again — credentials sitting inside a dev tool are exfiltrated, and bots burn them within hours. If the key was never in the tool, there is nothing to steal.
Cloud vaults were built for humans logging in, not autonomous agents asking mid-task, fifty times a day. OpenVault keeps keys on your machine, encrypted at rest, under your OS keychain.
How it works
Like a crypto wallet — except the payloads are API requests, and they are far more complex than a signature.
Encrypted keys, hard policy ceilings, expiring grants. No intelligence, no surprises. Secure with the model switched off.
A Meta LLM assesses every requestor and every request: scope, history, intent. It never sees plaintext keys. Ever.
Add each key once. AES-256-GCM at rest, master key in your OS keychain.
Via one MCP snippet in any IDE: stripe · charges.read — never the key.
A local Meta model risk-scores the requestor, scope, and history. It can narrow or escalate — never widen.
One click in the desktop app. Writes always ask. Reads can earn standing approval.
The daemon injects the key into that single call, returns only the result, then the grant dies. TTL and event tripwires auto-revoke.
LLM Security Levels
The vault is secure with no model at all — deterministic policy is the floor.
Each warden tier adds judgement on top of that floor: spotting writes phrased as reads, slow scope-creep, and malicious requests from rogue agents you are testing. The floor itself never moves.
| Level | Warden | Runs | What you get |
|---|---|---|---|
| STANDARD · LOW | None — policy only | Anywhere | Hard ceilings, expiry, manual approval for everything sensitive. Safe, blunt. |
| GUARDED · MEDIUM | Llama 3.2 3B (Q4) | On-device, 8 GB GPU | Risk scoring, scope recommendation, one-line explanations. The default. |
| FORTIFIED · HIGH | Muse Glimmer 30B | On-device, 24 GB GPU | History pattern-spotting, injection resistance, senior-investigator judgement. |
| MAXIMUM | Muse Spark / Muse Wonder | Meta Model API | Frontier reasoning auditing every request. Metadata only — still no keys, ever. |
Request Logs
One timeline per request, with the model named on every warden row. If an agent asked for something at 3 a.m., you will see it — and exactly what happened next.
Agent and IDE, requested scope, the warden's assessment, the policy decision, your approval or denial, execution, expiry, revocation. Timestamped, in order.
No key value, fragment, or hash ever reaches the log — or any transcript. A canary test scans 17 surfaces in CI and fails the build on a single hit.
Distribution
Windows first. OpenVault is Apache-2.0 open source — audit it, fork it, run it air-gapped. A browser extension for agent request approval is on the roadmap.
From the team behind Keythings Wallet — we have shipped key management people trust with real assets. OpenVault is the same discipline, for the agent era. The future: hardened devices, secure enclaves, fully air-gapped vaults. Secure, easy, and full of possibility.