● CLIENT.ENCRYPTED ● SERVER.BLIND ● AGENT.NATIVE
v0.22.8-fbccfbe-eeaab9c8
// AGENT-NATIVE SECRETS
▣   AGENT-NATIVE SECRETS INFRASTRUCTURE

Give AI agents
production access without exposing secrets.

Wundervault injects credentials into the agent’s runtime — never into the chat. Claude, Cursor, OpenClaw, Hermes, and your own agents can deploy, call APIs, and query databases without ever seeing plaintext keys.

▸ START FREE ▸ HOW ONBOARDING WORKS
▣ NEW.SECRET
■ SECRET
aes-256-gcm · pbkdf2 0 / 65,536
■ EXPIRES
↺ burns on first read

Or share a one-time secret — a link + passphrase that self-destructs after a single read.

WORKS WITH
CLAUDE CURSOR OPENCLAW HERMES CHATGPT ANY MCP AGENT · HTTP API
01▸ THE STATUS QUO

Trust your agent with the job, not the keys.

Most teams hand AI agents the same long-lived credentials a human uses — pasted into chat, stored in .env, never rotated. One bad prompt, one leaked log, and the keys are out.

BEFORE your .env file today
AFTER your Wundervault dashboard
wundervault.com/dashboard ● VAULT.UNLOCKED
Wundervault dashboard — CREATE, MY SECRETS list, USAGE AUDIT LOG (dark theme) Wundervault dashboard — CREATE, MY SECRETS list, USAGE AUDIT LOG (light theme)
▸ click to open the live demo
AGENT VAULT VIEW what each agent sees — only what you grant it
wundervault.com/dashboard · Claude Code ● VAULT.UNLOCKED
Per-agent view: Claude Code with scoped vault contents, agent health, and access log (dark theme) Per-agent view: Claude Code with scoped vault contents, agent health, and access log (light theme)
▸ click to open the live demo
Encrypted at restAES-256-GCM · client-side keys
Injected at runtimeagent sees an env var, not a key
Scoped per agentClaude can deploy; Cursor cannot
Append-only auditevery read · every revoke
Revocable in 1spull a token; door closes
02▸ HOW IT WORKS

One token. One scope. One short life.

The agent asks. The MCP server injects. The credential never crosses the model boundary.

AI AGENT
claude · cursor · openclaw · hermes
▸
WV MCP SERVER
local · uses your scoped agent key · vault_exec
▸
WUNDERVAULT VAULT
remote · server-blind · stores only ciphertext
▸
SECRET INJECTION
decrypted locally · into one command
▸
YOUR SERVICE
npm · aws · github · ssh · pg
▸
✗   PLAINTEXT NEVER ENTERS THE CHAT CONTEXT   ✗
03▸ REAL WORKFLOWS

What this actually looks like.

Three agents, three jobs, three different keys — each agent gets only the scope its work requires.

● PUBLISH AGENT → NPM PUBLISH · TOKEN INJECTED PER-COMMAND
vault_exec(entry_id: NpmToken, command: "npm publish --access public")
✓ ALLOWED
NpmToken
✗ BLOCKED
StripeLiveKey
ProdDbPassword
✓ Published v1.6.2 · NPM_TOKEN injected into one command only
● OPS AGENT → QUERY PROD OVER SSH
vault_exec(entry_id: ProdDbPassword, remote_host: prod, command: "curl -u admin:$DB_PASSWORD …")
✓ ALLOWED
ProdDbPassword
ProdSshKey
✗ BLOCKED
StripeLiveKey
NpmToken
✓ 14 rows returned · $() / backticks hard-blocked before decrypt
● DEPLOY AGENT → RSYNC TO PROD
vault_rsync(ssh_key_entry_id: ProdSshKey, local_path: ./dist/, remote_host: prod, remote_path: /var/www/html)
✓ ALLOWED
ProdSshKey
✗ BLOCKED
ProdDbPassword
StripeLiveKey
✓ Synced · key written to tempfile, deleted after transfer
04▸ WHAT THE SERVER SEES

Ciphertext, a salt, a nonce, and a one-way verifier. That’s the whole row.

Encryption happens in your browser via the Web Crypto API. The server stores only AES-256-GCM ciphertext plus the values needed to authorize retrieval — it cannot derive the key, the passphrase, or the plaintext. Don’t take our word for it: verify this claim yourself in 5 minutes →

▸ DATABASE ROWnothing readable
▸ attempt: decrypt(row #84217) → key required (derived client-side from passphrase) → key on this server: ∅ never stored → result: NULL · plaintext unreachable from the server side
KEYNEVER — derived locally from passphrase
PLAINTEXTNEVER — never leaves your device
▸ CRYPTO PRIMITIVES
cipherAES-256-GCM · authenticated encryption · Web Crypto API
kdfPBKDF2-HMAC-SHA256 · 600,000 iterations · per-secret salt
nonce12-byte random · never reused · crypto.getRandomValues
signingEd25519 · onboard script verifies its own signature
transportTLS · HSTS · strict CSP · preload list
key.storageAccount Secret · 128-bit in browser localStorage · never sent
auditHMAC-chained log · tamper-evident · agent · purpose · IP · outcome
05▸ ONBOARD AN AGENT · 90 SECONDS

Create your account, send your agent one link. It sets itself up.

Set up your account, register the agent, and the dashboard hands you a single onboarding command with a one-time setup link inside. Paste it to your agent — it does the rest autonomously: the Ed25519-signed onboard script (pipe execution hard-blocked) installs the MCP server, starts the local daemon, and registers the agent’s credentials in an encrypted profile. No plaintext on disk, no config for you to write.

# you: create account → register agent → copy the one command it gives you
# paste it to your agent — it runs everything itself:
$ curl -fsSL https://wundervault.com/onboard -o /tmp/wv-onboard.py && python3 /tmp/wv-onboard.py "$SETUP_URL"
✓ onboard.py signature verified · Ed25519
✓ @wundervault/mcp-server installed · npm, automatic
✓ credentials registered with local daemon · encrypted profile
✓ daemon started · setup link burned
# agent adds the printed snippet to its own MCP config, then:
$ claude → vault_exec(entry_id: NpmToken, command: "npm publish")
✓ secret injected into agent runtime
✓ action audited · append-only log
✗ plaintext never exposed
▸ WHAT JUST HAPPENEDstep-by-step
  1. You created an account, registered the agent in the dashboard, and clicked 📨 SEND on the secrets it should see.
  2. The onboard script verified its Ed25519 signature, installed the MCP server, exchanged credentials, and burned the one-time setup URL.
  3. Your agent called vault_exec. The MCP server hard-blocked shell escapes before decrypting.
  4. The MCP server injected the secret as a named env var — stripped sensitive parent-env keys, zeroed the buffer after spawn, scrubbed output.
  5. The model received only a confirmation string. Plaintext never touched the conversation.
Tier 2 entries add a WebAuthn gate — the agent gets 403 until you biometric-unlock in the dashboard. Checked server-side on every request; the agent can never satisfy the gate itself.
THE MCP SERVER & CLIENT CRYPTO ARE OPEN SOURCE · AGPL-3.0 — GITHUB · NPM · LISTED IN THE OFFICIAL MCP REGISTRY
06▸ THREAT MODEL · WHITEPAPER §1, §9

What this fixes — and what it doesn’t.

Calibrated from the security whitepaper. §1 names the threat classes Wundervault is designed against; §9 names the limits inherent to browser-based crypto, endpoint trust, and revocation semantics.

✓ WUNDERVAULT PROTECTS AGAINST
✓passive DB compromise — dumps are ciphertext + salt + nonce only
✓network interception — TLS + client-side encryption before transit
✓credential brute force — PBKDF2-HMAC-SHA256 · 600,000 iterations
✓agent credential theft — setup link is single-use; credential hashed at rest (DB leak ≠ usable credential)
✓prompt injection → shell exec — $() / backticks / eval blocked before decrypt
✓cross-agent secret sharing — each agent has its own scoped vault
✓over-permissioned agents — only secrets you explicitly send are visible
✓long-lived tokens after staff turnover — revocation is immediate (401 next request)
✗ WUNDERVAULT WILL NOT PROTECT AGAINST
✗active server compromise serving malicious JS — browser-crypto trust limit (SRI helps)
✗endpoint compromise of your device — malware, keyloggers, screen capture
✗post-reveal capture — screenshots / copies / photos after a secret is shown
✗agent context persistence — revocation is forward-looking, not retroactive
✗SSH keys stored outside the vault — use ssh_key_entry_id to keep keys inside
✗intentionally authorized destructive actions — the agent is doing what you asked
✗metadata — secret existence, TTL, and access timestamps are visible to the server
▣  HOSTED FOR TEAMS · EARLY ACCESS

Running agents across a team?

We host Wundervault for you — a managed zero-knowledge vault, no self-hosting. We’re onboarding early-access design partners now.

▸ GET IN TOUCH

Log in to continue

Create a free account or log in to save secrets to your zero-knowledge vault.

Don't have an account? Create one free