Passwords
Logins, notes, identities, cards, wallets, and developer credentials are encrypted at rest.
Local-first private workspace
Your passwords, private files, and agent approvals stay under your control.
Vault works on one computer with no ShellX account or cloud service. Add an encrypted backup file or your own sync server when you want another copy. ShellX Drive is optional.
Safe Files
User-only sealed documents stay out of normal agent listing, search, MCP, and sync surfaces.
Storage you choose
Save an encrypted item backup locally, on USB, or inside another provider's synced folder.
Use, not reveal
An agent can request one exact operation. Vault never returns the raw password through MCP.
Interface map
Choose a feature in the manual tree.
Showing
Create on this computer
The outlined control is the exact place described below.
Get startedChoose where this Vault lives.
encrypted · local
NEW VAULT
Where should Vault store your encrypted data?
You can add another encrypted copy later.
RECOMMENDED
On this computer
No account or server required.
OPTIONAL SYNC
My server
Your HTTPS endpoint and device key.
Dashboard
Current Vault state and active secret surface.
Files 18Resources 4Stored 2.6 MiB
VaultWork account ASK EACH USEMain identity USER ONLYDeveloper token POLICY ALLOWED
PasswordsEncrypted logins and typed resources.
Private resourcesMain identity PROFILE CARDWork card USER ONLYAgent wallet POLICY ALLOWED
Safe FilesUser-only sealed documents.
contract-review.mdsealed · 18 KiBQuick view
Local previewRendered inside Vault
# Contract review
Private working notes stay sealed.
1 pending requestExpires in 4:32Open request →
UNVERIFIED AGENT REASONSign in to the package registry
- Program
- /usr/bin/npm
- Resource
- Registry account
- Injection
- password → NPM_TOKEN
- Timeout
- 60 seconds
Encrypted backup fileShellX Drive backupPlaintext Drive spaces
One encrypted file, anywhere you choose
Protected with its own export passphrase.
••••••••••••••••
Restore preview3 added · 1 updated · 0 replaced
OPTIONAL INTEGRATIONEncrypted Vault backup in ShellX Drive
Drive stores the already-encrypted Vault blob and cannot decrypt it.
SEPARATE FILE WORKFLOWPlaintext Drive spaces
This Drive server may read file bodies. These files do not carry Vault protection.
ActivityRedacted security receipts.Search receipts
contract-review.mdPreviewed sealed metadata; plaintext stayed inside Vault.completed
- Surface
- Safe Folder
- Actor
- user
- Secret exposure
- none recorded
Local protection
Vault stays fully functional without a ShellX account.
CLIPBOARDCleared after copy where the OS permitsRECOVERY KITKeep it offline and separate
What Vault protects against
Accidental agent reads, normal indexing, synced-host decryption, and raw MCP secret retrieval. It cannot protect against same-user malware or a program you approve.
Sync SetsProject CapsulesMCP & debug
REUSABLE HANDOFFRelease documentation
Manual · ask before agent writes
EXPLICIT PROJECT SNAPSHOTWebsite refresh capsule
Preview every returned change before applying it.
MCP SERVERShellX Vault --mcp
MEDIATED REQUESTRun a direct program with approved fieldsAsk every time
Selected feature
Create a local Vault
Choose On this computer and create a passphrase. No account or server is required.
First run
Local by default. Server only when you choose it.
On this computer
Create a passphrase twice. Vault creates the encrypted local store and opens without an account, token, or network service.
My server
For the optional encrypted sync service, enter its HTTPS URL, repository, per-device token, keyfile, and passphrase. The server never receives the master key or plaintext names.
Remembered profile
Vault may remember server, token, and wrapped keyfile on this device. It never remembers the passphrase.
Recovery
A local Vault requires its passphrase. A remote profile also requires its keyfile and device setup. Loss of the required key material is unrecoverable by design.
Passwords and private data
Store the item once, then choose how agents may discover it.
Add and edit
Create a Login or Note, or use typed resources for an identity, payment card, agent wallet, inbox, or developer credential. Password generation is available in the editor.
Copy without reveal
Copy a username or password without first showing it. Vault attempts to clear the active clipboard after about 30 seconds, but clipboard-history tools may retain a copy.
Only user
The item is omitted from agent resource discovery and cannot be used by the MCP request flow.
Ask agents
Non-secret label and field names may be listed. Every MCP process request still waits for owner approval.
Policy-allowed
The shared broker can permit scoped mediated actions on compatible surfaces. The standalone MCP release still asks before every process launch.
Delete
Deletion requires confirmation. Keep a current encrypted backup before removing the only copy of an important credential.
Safe Files
A user-only space, not an agent file store.
Hard boundary
Agents cannot list, read, search, or export Safe Files through Vault, ShellX, MCP, CLI, connectors, or the release Debug API. Moving a decrypted copy outside Safe Files crosses that boundary.
Import
Choose a file, validate its name and content, seal it into the protected store, and record a receipt. Normal agent-visible file indexes remain empty.
Text and Markdown
Quick view is rendered locally as pixels. Explicit Reveal enables the built-in editor; Save and Discard use short-lived owner handles.
Other formats
Images, PDFs, Office files, and binaries are metadata-only in this release unless a hardened in-memory renderer is available.
External open
An external app may create plaintext temp files, thumbnails, autosaves, recent-file entries, or cloud copies outside Vault control.
Export
Export creates a decrypted copy outside Safe Files. Vault warns and records the action; protection does not follow the plaintext copy.
What it stops
Accidental agent reads, normal grep/indexing, sync exposure, and prompt-context ingestion. It does not stop same-user malware, screenshots, OCR, or process-memory inspection.
Approvals
Review the exact operation, not the agent's promise.
The approved child receives the secret
Vault keeps the value out of MCP, model context, and stored results. The child program must receive it to authenticate and can use, retain, or transmit it. Approve only a program or explicit script file you trust.
- RequestThe agent names an absolute executable, arguments, working directory, timeout, purpose, and field-to-environment mappings.
- ReviewVault marks agent prose as unverified and shows a trusted summary, actor, device, program identity, resource labels, and expiry.
- Choose onceDeny or Run program once. Approval is digest-bound, delayed briefly, and cannot be triggered by Enter.
- ExecuteVault clears the environment, launches the program directly without a shell, injects the selected values, and enforces the timeout.
- ReceiptThe agent gets status and capped, redacted output. The secret is not returned.
Sync and backup
Three destinations, three different security meanings.
| Choice | What it is | Important boundary |
|---|---|---|
| Encrypted backup file | A portable item backup protected by its own export passphrase; save it anywhere. | Backup, not two-way sync. Preview before restore; newer local items are kept. |
| ShellX Drive backup | An optional copy of Vault's already-encrypted store in a sealed Drive workspace. | Drive is a destination, never a requirement for standalone Vault. |
| Plaintext Drive space | A separate file-sync workflow whose server may read file bodies. | Those files do not carry the Vault shield and must not be described as encrypted Vault backup. |
Restore is a merge
The preview lists added, updated, locally newer, and unchanged items. Restore adds missing items and applies only a backup item newer than the local copy. It never replaces a newer local item with stale backup data.
MCP setup
Run the installed app in protocol mode.
Use the full path to the installed Vault executable and pass --mcp. Keep Vault open and unlocked when an approval needs to run.
{
"mcpServers": {
"shellx-vault": {
"command": "/full/path/to/ShellX Vault",
"args": ["--mcp"]
}
}
}Windows
Select the installed ShellX Vault.exe under the installation directory and add --mcp.
macOS
Use /Applications/ShellX Vault.app/Contents/MacOS/ShellX Vault with --mcp.
Linux
Use the installed shellx-vault executable with --mcp.
Source build
cargo build --release -p vault-mcp also creates the dedicated shellx-vault-mcp server.
| Tool | Result |
|---|---|
vault_list_resources | Non-secret labels, IDs, kinds, permissions, and field names. |
vault_run_with_secrets | Creates an owner approval request for one exact direct executable. |
vault_request_status | Returns pending, running, completed, failed, denied, cancelled, or expired. |
vault_cancel_request | Cancels the same client's still-pending request. |
There is no raw-secret reveal tool. Inline bash -c, cmd /c, PowerShell command strings, Python -c, and similar evaluation are refused. Use a direct executable or an explicit script file the owner can identify.
Security boundaries
Know exactly what Vault can and cannot protect.
Protected
Server-side plaintext disclosure, accidental agent secret retrieval, normal file indexing of Safe Files, stale request approval, standing MCP secret reveal, and obvious loader-environment injection.
Not protected
A compromised unlocked client, same-user malware, keylogging, screen capture/OCR, process-memory inspection, traffic analysis, or a program the owner approves.
Lock behavior
Lock clears owner UI access and preview/editor sessions. It does not terminate a child process you already approved.
Clipboard behavior
Active clipboard clearing is best effort. OS clipboard history, remote clipboard, and third-party clipboard managers can keep old values.
Request limits
Pending requests expire after five minutes. The queue is capped at 20 and temporarily refuses a sixth pending request from one actor in a minute.
Receipts
Activity records redacted decisions and results. Exact injected values are removed from captured output before persistence.
Developer tools
Optional project workflows stay out of the primary Vault path.
Sync Sets
Reusable file handoffs with manual, watch, or scheduled policy and explicit agent-write controls.
Project Capsules
Explicit project snapshots and return capsules for moving work between machines without live-syncing an active coding directory.
Debug API
Available only in debug or explicitly enabled builds. It is loopback-only, bearer-protected, and excluded from default release builds.
ShellX integration
ShellX can use the same profile and broker as a client. Standalone Vault remains authoritative; ShellX is not required.