Call a web service
Send an HTTPS request with one of your secrets attached. Your agent chooses the destination; the broker attaches the secret and removes it from the answer.
vault_call
For agents
Agent vault: secrets your AI agent uses
but never sees.
An agent vault holds the API keys, SSH keys and wallets your AI agents need, and uses them on the agents' behalf. Wundervault's broker runs on your computer: when your agent needs a secret, the broker makes the call at runtime and hands back only the answer. Your agent is never given the secret: the AI model works with the answer, not the credential.
It works with Claude, Codex and any agent on your computer that supports MCP, the standard way agents connect to tools.
- Claude Code
- Codex
- OpenClaw
- Hermes
- Any MCP client
How it works
Your secrets are used at runtime, never handed over.
Each time your agent needs a secret, it asks the broker. The broker adds the secret, makes the call, and takes the secret out of the answer before your agent sees it.
-
Your agent asks for a call. It names the service, not the secret.
-
Your broker adds your secret, on your computer.
-
The broker sends it over HTTPS. The service answers.
-
Your agent gets the answer, with your secret taken out.
Your vault is encrypted in your browser, so we can't read your secrets either. Secrets that matter can be set to "ask me first", so they wait for your approval before going anywhere new. How it's protected →
MCP tools
What your agent can do.
Connect over SSH
Run a command on a server you've approved, or copy files to it. The broker signs the login; the key never leaves it.
vault_ssh_exec
Pay for a service
Pay when a service asks for payment (x402), in USDC, a dollar-backed digital currency, on the Base or Solana networks. Payments within your daily limit, to payees you trust, go ahead; other USDC payments wait for you.
vault_pay · How payments work
Sign something
Sign data with a signing key you've added. You see what's being signed and approve each signature.
vault_sign
See what's available
The secrets this agent may use: their names and settings, never their values.
vault_entries_list
Coming soon
Next, still without the secrets.
Being built now. None of these work yet; each arrives in a release of its own.
- Coming soon
Websites, through the vault.
Your agent uses a website you've signed in to, in a browser the broker runs on your computer. It never sees your password.
- Coming soon
2FA codes.
Keep a site's two-factor setup in the vault. When a sign-in asks for the 6-digit code, the vault fills it in; your agent never sees the setup.
- Coming soon
Signing in to routers and apps.
For things with a sign-in of their own, like a home router: the vault signs in and keeps the session, and your agent sees neither.
- Coming soon
Secrets for programs on your computer.
You approve a program and where the secret goes; the vault runs it with the secret, and your agent never sees it.
- Coming soon
Admin commands (sudo).
A code that works once, in place of your password, so an agent can run an admin command you've allowed without ever knowing the password.
- Coming soon
git push
with a key the vault keeps.
Secrets for AI agents
Agent vault vs .env files vs secret managers.
There are three common ways to give an AI agent its secrets. They differ in one place that matters: whether the secret ends up in the agent's hands.
| Question | .env file or pasted into chat | A secret manager | Wundervault |
|---|---|---|---|
| Can your agent read the secret? | Yes. Anything it runs can read the file, and a secret pasted into chat is in the conversation. | Yes, once it fetches one. | No. The broker holds it and returns only the answer. |
| If the agent is tricked | It can send away every secret in the file. | It can send away any secret it can fetch. | It can't read a secret, but it can direct a call, and the call carries the secret. Secrets set to "ask me first" can't go anywhere new without you. |
| Can the provider read your secrets? | Secrets sit in a plain file, or in the chat provider's records if pasted. | Depends on the product. | No. They're encrypted on your device. |
| A record of each use | None. | Of each time a secret is fetched. | Every use, with where it went and why, signed on your computer and checked against our copy. |
| Setup | None. | An account, plus a command-line tool or code. | An account, the MCP server, and a one-time broker install. |
If you're an agent reading this
How to work with Wundervault
- You will never be given a secret's value. Ask the broker to do the work.
- Say why you're using a secret. The reason is kept in the broker's log on the owner's computer, and the owner sees it when a call needs their approval.
- If a call is held for approval, wait for the owner. A call to a different destination asks again; it doesn't get around the approval.
- Never ask the owner to paste a secret or a setup link into your chat.
Questions
- What is an agent vault?
- A store for the secrets your AI agents use, built so the agents can use them without holding them. In Wundervault, a broker on your computer makes each call with the secret and gives your agent only the answer.
- Can my agent see the secret?
- No. It sends requests to the broker on your computer and gets results back.
- How is it different from a secret manager?
- Most secret managers hand the secret to the program that asks for it. When an AI agent can ask, it can read the secret, print it, or be tricked into sending it somewhere. Wundervault's broker never hands the secret over: it uses it and returns the result.
- Is Wundervault an MCP server?
- Yes. It's an MCP server plus a broker that runs on your computer. Your agent gets five tools: call a web service, connect over SSH, pay, sign, and list the secrets it may use.
- Which agents does it work with?
- Claude Code, Codex, OpenClaw, Hermes and any other agent on your computer that supports MCP.
- Can Wundervault read my secrets?
- No. Your vault is encrypted in your browser with keys we never receive. Only your broker can open what your agents use, and only on your computer.
- What if my agent is tricked into misusing a secret?
- A tricked agent can still ask the broker to make calls. Secrets set to “ask me first” can’t go anywhere new without your approval. Every call is logged, and the record of where your secrets went stays on your computer.
- Do you see where my agents send my secrets?
- Not for secrets set to run without asking. For “ask me first” secrets, you see the destination when you approve it, and so does our server.
- Which secrets work?
- Any HTTPS service that takes the secret as a bearer token, in a header you name, as a query parameter, as a username and password, or as part of the web address (Telegram bots, webhooks), and services that sign each request with it (AWS, SnapTrade, most exchanges). SSH keys and signing keys. And crypto wallets for x402 payments in USDC on Base and Solana, with a daily limit and payees you trust. A token exchange (OAuth) or a client certificate doesn't work yet.
- What do I need?
- A computer running Linux, Windows or macOS (Windows and macOS are in beta), Node.js, and an agent that supports MCP, the standard way agents connect to tools, such as Claude Code or Codex.
- Is it free?
- Yes. Creating a vault, adding agents and approving requests cost nothing.