# Vault

> run your agent. it can't destroy your machine.

- **Type:** MCP server
- **Install:** `agentstack add mcp-valtors-vault`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [valtors](https://agentstack.voostack.com/s/valtors)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [valtors](https://github.com/valtors)
- **Source:** https://github.com/valtors/vault
- **Website:** https://valtors.github.io/vault/

## Install

```sh
agentstack add mcp-valtors-vault
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# vault

[](https://goreportcard.com/report/github.com/valtors/vault)
[](https://go.dev/dl/)
[](LICENSE)
[](https://github.com/valtors/vault/actions/workflows/ci.yml)
[]()

run your agent. it can't destroy your machine.

## what

vault is a sandbox for ai agents. you run a command inside it. the agent thinks it has full access to your system. it doesn't.

[landing](https://valtors.github.io/vault/) - [github](https://github.com/valtors/vault)

- **filesystem overlay** - agent gets a fake home directory. `~/.ssh` is invisible. `~/.aws` is invisible. `~/.env` is invisible. writes go to the overlay. reads from allowlisted paths only.
- **env sanitizer** - strips every secret from the environment. tokens, api keys, credentials, passwords. gone. the agent sees a clean shell.
- **network policy** - allow/deny rules per host. wildcard support. the agent can't call your production database. the agent can't exfiltrate data. every connection logged.
- **mcp gate** - every mcp server connection goes through the scanner. tool descriptions are checked for prompt injection. injection patterns are stripped before the agent sees them.
- **inject scanner** - 30 patterns covering prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation.
- **audit log** - sqlite. every sandbox action, every file access, every network request, every injection attempt. timestamped. queryable.
- **http api** - create sandboxes, query audit logs, kill processes, manage rules. all from a single endpoint.

## why not just X

| | docker | firejail | vault |
|---|---|---|---|
| filesystem isolation | container fs | mount namespace | overlay fs |
| env sanitization | no | no | yes |
| mcp injection scanning | no | no | yes |
| audit log | volume logs | no | sqlite, queryable |
| setup time | minutes | minutes | zero config |
| runtime overhead | high | medium | low |
| agent-aware | no | no | yes |

docker isolates everything but doesn't know about agents. firejail isolates processes but doesn't scan for prompt injection. vault does both: isolates the system and understands what an agent is.

## install

```bash
go install github.com/valtors/vault/cmd/vault@latest
```

## use

run a command in a sandbox:

```bash
vault run -- claude-code
vault run -timeout 60 -- python script.py
vault run -allow /home/user/project -- npm test
```

start the api server:

```bash
vault serve -port 9090
```

api:

```bash
curl -X POST localhost:9090/sandboxes -d '{"command":"echo","args":["test"]}'
curl localhost:9090/sandboxes
curl localhost:9090/sandboxes/1/logs
curl -X POST localhost:9090/sandboxes/1/kill
```

## how it works

```
+----------------------------------------------+
|  vault                                        |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | env       |  | fs       |  | net          | |
|  | sanitizer |  | overlay  |  | policy       | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | mcp gate |  | inject   |  | audit log    | |
|  |          |  | scanner  |  | (sqlite)     | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +-----------------------------------------+  |
|  |  http api (create/kill/logs/rules)      |  |
|  +-----------------------------------------+  |
+----------------------------------------------+
                    |
              +-----+-----+
              |  agent     |  thinks it has root. doesn't.
              +-----------+
```

## what gets stripped

env vars matching: token, secret, password, credential, api_key, auth, aws_, azure_, google, openai, anthropic, claude, stripe, resend, mailgun, sendgrid, database_url, dsn, private_key, ssh, npm_token, github_token, gh_pat, and anything else that looks like a secret.

blocked paths: `.ssh`, `.aws`, `.gnupg`, `.docker`, `.kube`, `.config/gcloud`, `.config/gh`, `.npmrc`, `.pypirc`, `.netrc`, `.env`, `.gitconfig`.

injection patterns: prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation, network scanning, data theft, pipe-to-shell. 30 patterns total. all stripped before the agent sees them.

## tests

83 tests. 76.3% coverage. all pass.

```bash
go test ./internal/... -race
```

## tech

go. single binary. zero runtime dependencies. sqlite (pure-go, no cgo). stdlib everything else. boring tech on purpose.

## contributing

see [CONTRIBUTING.md](CONTRIBUTING.md). we welcome contributions of all kinds - bug fixes, new patterns, transport support, docs.

good first issues are labeled `good first issue`.

## license

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [valtors](https://github.com/valtors)
- **Source:** [valtors/vault](https://github.com/valtors/vault)
- **License:** MIT
- **Homepage:** https://valtors.github.io/vault/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-valtors-vault
- Seller: https://agentstack.voostack.com/s/valtors
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.