WUNDERVAULT START FREE

Install & upgrade

Install it. Check it. Upgrade it.

You're installing the Wundervault helper app. It runs in the background, does the work your agents ask for, and updates itself from your vault. There's nothing to open.

Exact versions, checksums and signature keys, computed from the current build, so you can check what you run. New here? Help walks through setup step by step.

Node.js 22.23.4, 24.22.1 or 26.12.1 or newer (not 23 or 25). These carry the October 21, 2026 Node.js security fix. The helper app won't start on an older Node, and its installer checks first.

The MCP package

Install the exact version. On Linux, with sudo: the helper app only runs a copy installed in a system folder, never one inside your home folder.

Linux

sudo npm install -g @wundervault/mcp-server@2.4.0

macOS

npm install -g @wundervault/mcp-server@2.4.0

If npm stops with a permission error (EACCES), run it again with sudo in front.

Windows

npm install -g @wundervault/mcp-server@2.4.0

npm checks every download against the fingerprint it holds for that version. To see that fingerprint, and compare it with the one on our GitHub release:

npm view @wundervault/mcp-server@2.4.0 dist.integrity

This shows npm's record. It proves your install matches what npm serves, not that npm serves what we published: that is what the GitHub release and the MCP Registry listing below are for.

  • Source, AGPL-3.0: github.com/wundervault/wundervault-mcp. The helper app and the browser encryption are open source.
  • Official MCP Registry: listed as io.github.wundervault/wundervault-mcp. The registry checks that the npm package and our GitHub organisation match.

The helper app

One administrator step per computer. The installer creates the helper app’s own account and its private folder. It downloads nothing and is short enough to read first.

Linux

sudo sh "$(npm root -g)/@wundervault/mcp-server/packaging/install-daemon.sh"
sudo /opt/wundervault/current/node /opt/wundervault/current/app/bin/wundervault-agent --pair

macOS

In Terminal:

cd "$(npm root -g)/@wundervault/mcp-server"
sudo sh packaging/install-daemon-macos.sh
sh packaging/verify-macos.sh
sudo /opt/wundervault/current/node /opt/wundervault/current/app/bin/wundervault-agent --pair

Windows

In an Administrator PowerShell:

Set-Location (Join-Path (npm root -g) "@wundervault\mcp-server")
powershell -ExecutionPolicy Bypass -File packaging\install-daemon-windows.ps1
powershell -ExecutionPolicy Bypass -File packaging\verify-windows.ps1
wundervault-agent --pair

The last line pairs this computer: run the pairing command the installer printed. Paths can differ: use the ones your installer printed. Full paths, because with sudo a bare name could be found in a folder your agents can write.

If a step fails, tell us what it printed.

Updating

When a new version is out, update on each computer your agents use. The vault tells you when one of them is behind, and the changelog says what changed.

On version 2.2.0 or newer: open Computers in your vault, choose Update now and confirm with your passkey. The helper app checks the update is signed by us, installs it and restarts. Nothing to type.

On an older version: update to 2.2.0 by hand, once, on each computer. This is the last update you do this way.

Linux

sudo npm install -g @wundervault/mcp-server@latest
sudo sh "$(npm root -g)/@wundervault/mcp-server/packaging/install-daemon.sh"

macOS

In Terminal:

sudo npm install -g @wundervault/mcp-server@latest
cd "$(npm root -g)/@wundervault/mcp-server"
sudo sh packaging/install-daemon-macos.sh

Windows

In an Administrator PowerShell:

npm install -g @wundervault/mcp-server@latest
Set-Location (Join-Path (npm root -g) "@wundervault\mcp-server")
powershell -ExecutionPolicy Bypass -File packaging\install-daemon-windows.ps1
  • You don't need to pair again. The installer keeps this computer's pairing. It ends by printing the steps for a new computer: if this computer is already listed under Computers in your vault, skip them.
  • Then quit and reopen your agent apps, so they use the new version.
  • Still on version 1 (1.7.1 or older)? Version 2 is not a one-line update: upgrading from version 1.

Upgrading from version 1

Version 2 moves your secrets into the helper app. Your account, vault and passkeys carry over as they are. Agents still on version 1 can't use your secrets, so move each one.

  1. Install version 2: sudo npm install -g @wundervault/mcp-server@2 on Linux, npm install -g @wundervault/mcp-server@2 on macOS and Windows.
  2. Install the helper app and pair it (above).
  3. Quit and reopen each agent app (Claude Code, Claude Desktop, OpenClaw, Hermes…). An app that stays open keeps running the old copy, and that copy holds the agent's place, so the new one can't start.
  4. For each agent: open Agents in your vault, choose Repair and this computer, then paste the message you get into the agent's chat (or run wundervault-agent --enrol and enter its claim code yourself).
  5. When every agent has moved: wundervault-agent --migrate --finish removes the old credential store.
  6. Your vault marks each secret your agents could read before version 2 with a blue dot and Replace it. Replace those secrets at the services that issued them: treat them as seen.

The onboarding script

The script, its signature and the key below all come from this website, so on their own they can't prove this website wasn't tampered with. The same script and key are published on GitHub; Verify it yourself shows how to compare them.

The onboarding script is served at wundervault.com/onboard. Download it first — pipe mode (curl ... | python3) is hard-blocked by the script, which detects it and exits immediately.

curl -fsSL https://wundervault.com/onboard -o /tmp/wv-onboard.py
curl -fsSL https://wundervault.com/onboard.sig -o /tmp/wv-onboard.py.sig

SHA-256 Checksum

Current checksum of the onboarding script (computed live):

bc2a6c422bec64fbeb575f37bb90cee9aa04f7135928f69edbc88ee1932645f5  wv-onboard.py

Verify locally after downloading:

sha256sum /tmp/wv-onboard.py

Ed25519 Signature

The script also carries an ed25519 signature, available at wundervault.com/onboard.sig. The script verifies this automatically on startup — if the signature check fails, it aborts before doing anything.

Public key for independent verification:

3yhfVM5ABcBHPGSuZSQuIxr0C9QkHnFKoGMWwcWpooY=

Verify manually with Python:

python3 - <<'EOF'
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
from cryptography.exceptions import InvalidSignature
import base64, pathlib

pubkey_b64 = "3yhfVM5ABcBHPGSuZSQuIxr0C9QkHnFKoGMWwcWpooY="
script = pathlib.Path("/tmp/wv-onboard.py").read_bytes()
sig_b64  = pathlib.Path("/tmp/wv-onboard.py.sig").read_text().strip()

pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(pubkey_b64))
try:
    pub.verify(base64.b64decode(sig_b64), script)
    print("✅ Signature valid")
except InvalidSignature:
    print("❌ Signature invalid — do not run this script")
EOF

The cryptography package is required: pip install cryptography