Get started
Your agent, your secret, and a helper app between them.
Say you use an AI agent on your laptop, and you'd like it to manage your Cloudflare sites. That needs your Cloudflare key, and you'd rather the agent never saw it. Here's how that goes with Wundervault, from the start. When you're ready to do it, Help has every step.
-
Chapter 1
You make a vault.
You sign up with your email, then choose a passphrase. Your browser uses it to lock your vault before anything is saved, so what we store is locked and we can't open it. You save a set of recovery codes, in case you ever lose everything else.
Then you add a passkey: from now on a touch of your finger, or a glance, signs you in, and on most devices it opens your vault too.
-
Chapter 2
Your laptop gets a helper app.
The helper app is a small program that will hold your secrets and use them on your agent's behalf. It runs under an account of its own on your laptop, one your agent can't open. That separation is the whole point: your agent can ask the helper app for things, but it can't reach in.
So you set it up yourself, not through your agent. You install it as an administrator, then pair it with your vault: your laptop shows a fingerprint, your vault shows one, and you check they match. Now your vault knows exactly which helper app to trust.
-
Chapter 3
You introduce your agent.
In your vault you add an agent, give it a name and choose your laptop. The vault gives you a short message to paste into your agent's chat. Inside it is a claim code that works once, on that laptop only, for 15 minutes. It isn't a secret, so it's safe in a chat. Your agent reads the message and connects itself to the helper app.
-
Chapter 4
The secret goes to the vault, not the agent.
You paste your Cloudflare key into your vault. Your browser recognises many kinds of secret and suggests how each service expects it sent, then locks it before it's saved. You give it to your agent, and choose how much it needs you: "Runs without asking" for everyday secrets, or "Asks me first" for the ones that matter.
-
Chapter 5
Your agent asks. The helper app answers.
You ask your agent to list your Cloudflare sites. It asks the helper app, the helper app calls Cloudflare with your key, and the list comes back with the key taken out. Your agent did the work and never saw the key.
If you chose "Asks me first", a call to somewhere new waits for you: we email you, and you approve it with your passkey, from your phone or your computer. Either way it's written down: in your vault's Activity, and in a fuller log on your laptop that your agent can't read.
-
And if something seems off
You stay in charge.
One button pauses every agent at once, or just one agent, or just one secret. You can take a secret back from an agent, give it one until a date you choose, or repair an agent's connection after a move. Nothing about this needs your agent's help.
Using version 1 of Wundervault? Here's how to upgrade.