Vault

vault

[](https://goreportcard.com/report/github.com/valtors/vault) [](https://go.dev/dl/) [](LICENSE) [](https://github.com/valtors/vault/actions/workflows/ci.yml) []()

run your agent. it can't destroy your machine.

what

vault is a sandbox for ai agents. you run a command inside it. the agent thinks it has full access to your system. it doesn't.

landing - github

• filesystem overlay - agent gets a fake home directory. ~/.ssh is invisible. ~/.aws is invisible. ~/.env is invisible. writes go to the overlay. reads from allowlisted paths only.
• env sanitizer - strips every secret from the environment. tokens, api keys, credentials, passwords. gone. the agent sees a clean shell.
• network policy - allow/deny rules per host. wildcard support. the agent can't call your production database. the agent can't exfiltrate data. every connection logged.
• mcp gate - every mcp server connection goes through the scanner. tool descriptions are checked for prompt injection. injection patterns are stripped before the agent sees them.
• inject scanner - 30 patterns covering prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation.
• audit log - sqlite. every sandbox action, every file access, every network request, every injection attempt. timestamped. queryable.
• http api - create sandboxes, query audit logs, kill processes, manage rules. all from a single endpoint.

why not just X

| | docker | firejail | vault | |---|---|---|---| | filesystem isolation | container fs | mount namespace | overlay fs | | env sanitization | no | no | yes | | mcp injection scanning | no | no | yes | | audit log | volume logs | no | sqlite, queryable | | setup time | minutes | minutes | zero config | | runtime overhead | high | medium | low | | agent-aware | no | no | yes |

docker isolates everything but doesn't know about agents. firejail isolates processes but doesn't scan for prompt injection. vault does both: isolates the system and understands what an agent is.

install

go install github.com/valtors/vault/cmd/vault@latest

use

run a command in a sandbox:

vault run -- claude-code
vault run -timeout 60 -- python script.py
vault run -allow /home/user/project -- npm test

start the api server:

vault serve -port 9090

api:

curl -X POST localhost:9090/sandboxes -d '{"command":"echo","args":["test"]}'
curl localhost:9090/sandboxes
curl localhost:9090/sandboxes/1/logs
curl -X POST localhost:9090/sandboxes/1/kill

how it works

+----------------------------------------------+
|  vault                                        |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | env       |  | fs       |  | net          | |
|  | sanitizer |  | overlay  |  | policy       | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | mcp gate |  | inject   |  | audit log    | |
|  |          |  | scanner  |  | (sqlite)     | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +-----------------------------------------+  |
|  |  http api (create/kill/logs/rules)      |  |
|  +-----------------------------------------+  |
+----------------------------------------------+
                    |
              +-----+-----+
              |  agent     |  thinks it has root. doesn't.
              +-----------+

what gets stripped

env vars matching: token, secret, password, credential, apikey, auth, aws, azure, google, openai, anthropic, claude, stripe, resend, mailgun, sendgrid, databaseurl, dsn, privatekey, ssh, npmtoken, githubtoken, ghpat, and anything else that looks like a secret.

blocked paths: .ssh, .aws, .gnupg, .docker, .kube, .config/gcloud, .config/gh, .npmrc, .pypirc, .netrc, .env, .gitconfig.

injection patterns: prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation, network scanning, data theft, pipe-to-shell. 30 patterns total. all stripped before the agent sees them.

tests

83 tests. 76.3% coverage. all pass.

go test ./internal/... -race

tech

go. single binary. zero runtime dependencies. sqlite (pure-go, no cgo). stdlib everything else. boring tech on purpose.

contributing

see [CONTRIBUTING.md](CONTRIBUTING.md). we welcome contributions of all kinds - bug fixes, new patterns, transport support, docs.

good first issues are labeled good first issue.

license

MIT

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: valtors
• Source: valtors/vault
• License: MIT
• Homepage: https://valtors.github.io/vault/

Install and usage instructions live in the source repository linked above.