● CLIENT.ENCRYPTED ● SERVER.BLIND ● AGENT.NATIVE
v0.24.3-fb06775c
// AGENT-NATIVE SECRETS
▣   ZERO-KNOWLEDGE MCP SECRET VAULT

The MCP secret vault that gives agents
production access — without exposing secrets.

Your agent deploys, calls APIs and queries databases with credentials it never sees. Encrypted in your browser; injected into the process, not the chat.

▸ START FREE ▸ 5-MINUTE QUICKSTART
▣ SAVE.TO.VAULT encrypted in this tab
■ SECRET
aes-256-gcm · pbkdf2 0 / 65,536
■ NAME

Just need to send a password once? Make a one-time link — no account, destroyed on read.

WORKS WITH
CLAUDE CURSOR OPENCLAW HERMES CHATGPT GROK ANY MCP AGENT
▸ GET THE MCP SERVER WHERE YOUR AGENT ALREADY LIVES
OFFICIAL MCP REGISTRY SMITHERY GLAMA NPM GITHUB AWESOME MCP SERVERS CLAWHUB
01▸ THE STATUS QUO

Trust your agent with the job, not the keys.

A key pasted into a chat is in the transcript, the context window, and the provider's logs. It cannot be un-sent.

BEFORE your .env file today
AFTER your Wundervault dashboard
wundervault.com/dashboard ● VAULT.UNLOCKED
Wundervault dashboard — CREATE, MY SECRETS list, USAGE AUDIT LOG (dark theme) Wundervault dashboard — CREATE, MY SECRETS list, USAGE AUDIT LOG (light theme)
▸ click to open the live demo
AGENT VAULT VIEW what each agent sees — only what you grant it
wundervault.com/dashboard · Claude Code ● VAULT.UNLOCKED
Per-agent view: Claude Code with scoped vault contents, agent health, and access log (dark theme) Per-agent view: Claude Code with scoped vault contents, agent health, and access log (light theme)
▸ click to open the live demo
Encrypted at restAES-256-GCM · client-side keys
Injected at runtimeinto the child process, not the model
Scoped per agentClaude can deploy; Cursor cannot
Tamper-evident auditevery read · every revoke
Revocablethe next call fails; a running one does not
02▸ WHAT THE SERVER SEES

Ciphertext, a salt, a nonce, and a one-way verifier. That’s the whole secret.

Encryption happens in your browser. This is everything the row holds — names and access times we do see, and say so below. Watch your own traffic and check →

▸ DATABASE ROWnothing readable
▸ attempt: decrypt(row #84217) → key required (derived client-side from passphrase) → key on this server: ∅ never stored → result: NULL · plaintext unreachable from the server side
KEYNEVER — derived locally from passphrase
PLAINTEXTNEVER — never leaves your device
▸ CRYPTO PRIMITIVES
cipherAES-256-GCM · authenticated encryption · Web Crypto API
kdfPBKDF2-HMAC-SHA256 · 600,000 iterations · per-secret salt
nonce12-byte random · never reused · crypto.getRandomValues
signingEd25519 · onboard script verifies its own signature
transportTLS · HSTS · strict CSP · preload list
key.storageAccount Secret · 128-bit in browser localStorage · never sent
agent.keyOne vault key per agent · wrapped for it in your browser · how
auditHMAC-chained log · tamper-evident · agent · purpose · IP · outcome
03▸ HOW IT WORKS

One token. One scope. One short life.

The agent asks. The MCP server injects. The credential never crosses the model boundary.

AI AGENT
claude · cursor · grok · openclaw · hermes
▸
WV MCP SERVER
local · uses your scoped agent key · vault_exec
▸
WUNDERVAULT VAULT
remote · server-blind · stores only ciphertext
▸
SECRET INJECTION
decrypted locally · into one command
▸
YOUR SERVICE
npm · aws · github · ssh · pg
▸
✗   PLAINTEXT NEVER ENTERS THE CHAT CONTEXT   ✗
T2▸ THE APPROVAL GATE

Some secrets should wake you up.

Mark a secret Tier 2 and the agent has to ask. You decide how far the answer goes.

01 · BLOCKED

The agent asks for a Tier 2 secret and gets a 403.

It is handed a request id, so it waits and polls instead of failing blind.
02 · YOU DECIDE

You get an email. Approving takes a biometric or passphrase check.

ONCE15M 60MDENY
03 · SCOPED

The grant covers that agent and that secret — nothing else.

A window shows a live countdown and can be revoked mid-flight.
wundervault.com/dashboard · approvals ● 1 WAITING
Approvals panel: an open 11-minute window for Claude Code on stripe.live-key with a REVOKE button, and a pending request from Hermes for aws.deploy-key with ONCE, 15M, 60M and DENY buttons (dark theme) Approvals panel: an open 11-minute window for Claude Code on stripe.live-key with a REVOKE button, and a pending request from Hermes for aws.deploy-key with ONCE, 15M, 60M and DENY buttons (light theme)
▸ click to open the live demo

Enforced server-side on every request — an agent cannot approve itself. What it does not do is follow the secret afterwards. The full boundary is written down.

04▸ ONBOARD AN AGENT · 90 SECONDS

Create your account, send your agent one link. It sets itself up.

Paste one command to your agent. It installs the MCP server, registers its own credentials and burns the setup link — you write no config.

# you: create account → register agent → copy the one command it gives you
# paste it to your agent — it runs everything itself:
$ curl -fsSL https://wundervault.com/onboard -o /tmp/wv-onboard.py && python3 /tmp/wv-onboard.py "$SETUP_URL"
✓ onboard.py matches the copy published on GitHub · diff it yourself
✓ @wundervault/mcp-server installed · npm, automatic
✓ credentials registered with local daemon · encrypted profile
✓ daemon started · setup link burned
# agent adds the printed snippet to its own MCP config, then:
$ claude → vault_exec(entry_id: NpmToken, command: "npm publish")
✓ secret injected into agent runtime
✓ action audited · append-only log
✗ plaintext never exposed
STEP-BY-STEP FOR CLAUDE CODE & CURSOR → 5-MINUTE QUICKSTART

THE MCP SERVER & CLIENT CRYPTO ARE OPEN SOURCE · AGPL-3.0 — GITHUB · NPM · LISTED IN THE OFFICIAL MCP REGISTRY
05▸ THE BOUNDARY

What this stops, and what it doesn’t.

Stops a key reaching the model, the transcript, or your provider’s logs. The command it runs still holds it.
Does not sandbox the command. vault_exec is a shell with a credential attached.
Stops us reading your secrets — we hold ciphertext and no passphrase.
Does not hide metadata. Secret names and access times are visible to us.

The full list, including what we have got wrong and fixed, is on Known limitations. A security product that only tells you the good news is advertising.

▣  TEAMS · COMING SOON

Running agents across a team?

Wundervault is live and free to use today — this page is the hosted service. What is not built yet is the team layer: shared vaults, seats, and one audit trail across everyone's agents. Leave an email and we'll tell you when it opens. Nothing else is sent, ever. Prefer to talk? Get in touch.

Log in to continue

Create a free account or log in to save secrets to your zero-knowledge vault.

Don't have an account? Create one free