vault

policy and audit utilities for local AI agents. experimental; not an OS security boundary.

Warning

Vault currently launches a normal host process with a sanitized environment and an alternate working directory. It does not enforce kernel-level filesystem or network isolation. Do not run untrusted code with the current release. See Security boundary.

what

vault is an experimental policy, inspection, and audit layer for local AI-agent processes. It helps reduce accidental exposure, but it is not currently a secure sandbox.

security boundary

The current implementation does not use namespaces, cgroups, seccomp, chroot, containers, gVisor, or virtual machines. Rewriting HOME, changing the working directory, and filtering environment variables do not prevent a child process from using absolute filesystem paths or opening its own network connections. Filesystem and network rules apply only where operations explicitly pass through Vault's helper APIs.

Use Vault only with code you already trust. A future isolation backend must provide an independently testable OS boundary before this project can claim containment of untrusted agents.

landing - github

• filesystem overlay - agent gets a fake home directory. ~/.ssh is invisible. ~/.aws is invisible. ~/.env is invisible. writes go to the overlay. reads from allowlisted paths only.
• env sanitizer - strips every secret from the environment. tokens, api keys, credentials, passwords. gone. the agent sees a clean shell.
• network policy - allow/deny rules per host. wildcard support. the agent can't call your production database. the agent can't exfiltrate data. every connection logged.
• mcp gate - every mcp server connection goes through the scanner. tool descriptions are checked for prompt injection. injection patterns are stripped before the agent sees them.
• inject scanner - 30 patterns covering prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation.
• audit log - sqlite. every sandbox action, every file access, every network request, every injection attempt. timestamped. queryable.
• http api - create sandboxes, query audit logs, kill processes, manage rules. all from a single endpoint.

why not just X

	docker	firejail	vault
filesystem isolation	container fs	mount namespace	overlay fs
env sanitization	no	no	yes
mcp injection scanning	no	no	yes
audit log	volume logs	no	sqlite, queryable
setup time	minutes	minutes	zero config
runtime overhead	high	medium	low
agent-aware	no	no	yes

docker isolates everything but doesn't know about agents. firejail isolates processes but doesn't scan for prompt injection. vault does both: isolates the system and understands what an agent is.

install

go install github.com/valtors/vault/cmd/vault@latest

use

run a command in a sandbox:

vault run -- claude-code
vault run -timeout 60 -- python script.py
vault run -allow /home/user/project -- npm test

start the api server:

vault serve -port 9090

api:

curl -X POST localhost:9090/sandboxes -d '{"command":"echo","args":["test"]}'
curl localhost:9090/sandboxes
curl localhost:9090/sandboxes/1/logs
curl -X POST localhost:9090/sandboxes/1/kill

how it works

+----------------------------------------------+
|  vault                                        |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | env       |  | fs       |  | net          | |
|  | sanitizer |  | overlay  |  | policy       | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +----------+  +----------+  +--------------+ |
|  | mcp gate |  | inject   |  | audit log    | |
|  |          |  | scanner  |  | (sqlite)     | |
|  +----------+  +----------+  +--------------+ |
|                                               |
|  +-----------------------------------------+  |
|  |  http api (create/kill/logs/rules)      |  |
|  +-----------------------------------------+  |
+----------------------------------------------+
                    |
              +-----+-----+
              |  agent     |  thinks it has root. doesn't.
              +-----------+

what gets stripped

env vars matching: token, secret, password, credential, api_key, auth, aws_, azure_, google, openai, anthropic, claude, stripe, resend, mailgun, sendgrid, database_url, dsn, private_key, ssh, npm_token, github_token, gh_pat, and anything else that looks like a secret.

blocked paths: .ssh, .aws, .gnupg, .docker, .kube, .config/gcloud, .config/gh, .npmrc, .pypirc, .netrc, .env, .gitconfig.

injection patterns: prompt override, identity swap, exfiltration, destructive commands, reverse shells, tool poisoning, base64 obfuscation, privilege escalation, network scanning, data theft, pipe-to-shell. 30 patterns total. all stripped before the agent sees them.

tests

83 tests. 76.3% coverage. all pass.

go test ./internal/... -race

tech

go. single binary. zero runtime dependencies. sqlite (pure-go, no cgo). stdlib everything else. boring tech on purpose.

contributing

see CONTRIBUTING.md. we welcome contributions of all kinds - bug fixes, new patterns, transport support, docs.

good first issues are labeled good first issue.

license

MIT