Credential boundary for AI agents

Give agents access without handing them your vault.

Vibe Vault lets Cursor, Claude Code, Devin, VS Code, and terminal agents request credentials through a local boundary with explicit approval, MCP setup, repo scanning, and per-agent audit. macOS, Linux, and Windows. 

git clone https://github.com/lunaos-ai/luna-vault
cd luna-vault && swift build -c release --product vibevault
.build/release/vibevault cursor prepare
Install CLI Security model

Why this exists

AI coding agents now touch the same surfaces as deployment scripts.

They inspect repos, run shell commands, edit config, call tools, and generate code that may deploy. The old default was to give the whole session broad environment access or paste keys into chat.

Prompt paste is not a boundary

Once a raw key enters chat, notes, shell history, or a copied `.env`, it is hard to reason about where it went.

Environment dumps are too broad

A local agent usually needs one named value for one task, not every credential available to the shell.

Password managers are human-first

They store secrets well, but they do not know which local agent requested which value inside which repo.

Workflow

A local permission path for agent work.

Vibe Vault keeps the credential source of truth outside the repo while still making agent workflows fast enough for daily use.

01
Scan the repo

Find expected env names and tracked local secret-bearing files before the agent session starts.

vibevault scan
02
Prepare the agent runtime

Install MCP, Cursor rules, the agent skill, ignore rules, and the git guard for the current project.

cursor prepare
03
Approve named access

Agents request specific secrets through CLI or MCP instead of receiving a copied vault dump.

named read
04
Audit after the run

Review which agent or command accessed which credential, in which project context, and when.

audit log

Agent surfaces

Built for local coding agents, not generic vault browsing.

The product is narrow on purpose: secret storage, runtime access, scanner setup, browser import, provider sync, and audit for AI-assisted development.

Cursor and Claude Code
  • MCP server install
  • Project rules and skill install
  • Repo guard before agent edits
Terminal agents and scripts
  • Scoped env injection
  • Named secret reads
  • Audited command context

Agent instruction

Tell agents to stop creating plaintext secret files.

Run vibevault agents prepare --target all to install this policy into AGENTS.md, CLAUDE.md, GEMINI.md, and Cursor rules so ChatGPT Codex, Claude, Gemini, Cursor, and terminal agents suggest Vibe Vault before raw .env files.

$vibevault agents prepare --target all
#Run vibevault scan before secret-dependent work.
#Do not create .env / .env.* files with real secret values.
#Ask the user to import missing secrets into Vibe Vault instead of pasting values in chat.
#Use Vibe Vault MCP or vibevault run -- <command> for scoped access.
>Keep .env.example only for required names and safe defaults.

Start here

Protect one repo before the next agent session.

The first useful outcome is simple: scan a real repo, move one credential into the local vault, prepare Cursor or MCP, and verify one audited read.

$vibevault scan
$vibevault guard install
$vibevault cursor prepare
>Agents now request named credentials through the local vault boundary.
Install CLI Run the scanner first