WUNDERVAULT START FREE

Brokered secrets for AI agents

Give agents the work.
Keep the secrets.

Wundervault keeps your API keys, SSH keys, crypto wallets and signing keys with a broker on your own computer. Your agent asks; the broker makes the call, the payment or the signature, and only the result comes back.

Create your vault — free See how it works

Works with Claude, Codex and any agent that supports MCP, the standard way agents connect to tools.

Get the MCP server where your agent already lives

What happens when your agent needs a secret

One request, start to finish.

Example: you ask your agent to list your Cloudflare sites.

A brokered call Your computer holds your agent, and the broker in an account of its own, with your log beside it. One: the agent asks the broker to make a call, and the broker writes the request to your log, on your computer. Two: if the secret is set to ask first, you approve it yourself, with your passkey (face or fingerprint), on your phone or computer. Three: the broker calls the service with the secret. Four: the answer comes back through the broker with the secret removed. The secret goes only to the service, never to the agent. Your computer Own account Your account 1 2 3 4 Agent You approve with your passkey Broker Your log Service
The secret goes to the service, never to your agent. Your log stays on your computer.

  1. Your agent asks.

    It needs your Cloudflare key, so it asks the broker on your computer to make the call. The broker writes the request to your log, on your computer. Your agent never sees the key.

  2. Secrets that matter wait for you.

    If you set a secret to "ask me first", a call to somewhere new waits until you approve it with your passkey: your face, fingerprint or PIN, on your phone or computer.

  3. The broker makes the call.

    It runs under its own account, where your agents can't look. It attaches the key and sends the request to the service.

  4. Your agent gets the answer.

    The broker takes the key back out of anything that returns, so your agent gets the answer and never the key.

Using SSH? Your agent runs ssh and the broker signs the login. The key never leaves the broker. How it works

Built around your work

A small broker. A clear boundary.

Swipe or scroll sideways.

  • A woman at her laptop while a small agent hands a task to the broker box on her desk.
    Your agent asks. The broker acts.
  • A woman approves a request on her phone while the agent waits beside the broker.
    Secrets that matter wait for you.
  • A developer uses a terminal while the broker signs his login and keeps the key inside.
    SSH without handing over the key.
  • The broker returns a few result cards to the agent, its secret still locked inside.
    Answers come back. Secrets don't.
  • A man reviews a log of every use, beside the broker with its secret still inside.
    A record of every use.
  • A woman relaxes with a coffee while three agents get on with their own tasks.
    Many agents, one vault.

Three plain promises.

Your agent never holds the secret.

Not in its chat, not in a file it can read, not in its memory.

We can't read your vault.

It's encrypted on your device before it reaches us. How

You decide what needs individual approval.

Approvals for the secrets that matter, from any browser. How

Agent payments

Your agent can pay, too.

When a service charges per request (x402), your agent asks the broker to pay in USDC. Payments to payees you trust, within your daily limit, go ahead; other USDC payments wait for you, or every payment can ask you. Your agent never holds the wallet.

How agent payments work →

  • A daily limit you set, starting at $0
  • Payees you trust, by address
  • USDC on Base and Solana
  • Every payment in the signed log on your computer

Give your agents the secrets without giving them away.

Free to use. One command and one approval to set up.

Create your vault Read the setup guide