VaultMorph Guard

Stop your AI coding agent from leaking secrets it reads off disk.

Guard is an MCP server that sits between an AI coding agent (Claude Code, Cursor, Codex) and your local filesystem. The agent reads and writes files through Guard instead of directly — so a .env, an SSH key, or a customer export never reaches the agent's cloud LLM in real form. The agent works with placeholder tokens; real values only ever touch disk, never the network.

you: "the deploy is failing, check the .env and see what's misconfigured"
agent: [reads .env through Guard's safe_read]
        DATABASE_URL=<<VM_CONN_1_A3>>
        STRIPE_KEY=<<VM_KEY_2_F1>>
        ...
agent: "your DATABASE_URL host looks wrong, should be db.internal not db.local"
agent: [writes the fix through Guard's safe_write — the real values are
        restored on disk, never re-exposed to the agent or sent anywhere]

The gap this fills

Chat-box privacy tools (browser extensions that scan what you paste into ChatGPT) don't help here. There's no paste step — a coding agent reads files, runs commands, and calls the model's API autonomously. An agent debugging a deploy issue might read your .env and include it directly in a request to a cloud LLM, and nothing in the current privacy-tool market catches that, because it's not chat-box paste leaking, it's agent-reads-file leaking.

Install

npm install -g vaultmorph-guard
claude mcp add vaultmorph-guard -- vaultmorph-guard

(swap claude mcp add for the equivalent registration step in Cursor/Codex — see doc/cursor_codex_attachment.md. Both can use Guard's MCP tools; Cursor can additionally enforce the flow via its Hooks feature, close to Claude Code's non-overridable hook mechanism but not identical in shape — see that doc. Codex has neither today, noted honestly there, not glossed over)

That's it — no account, no API key. A Community license generates itself automatically, fully offline, on first run.

The command above registers Guard for the one project you're standing in. For it to actually protect you all the time — every project, without remembering to set each one up, plus the PreToolUse hook and the git pre-commit scanner turned on globally too — run the one-command global setup instead:

npm install -g vaultmorph-guard
vaultmorph-guard-setup

This registers the MCP server at --scope user (available in every Claude Code project on this machine), installs the PreToolUse hook into ~/.claude/settings.json (global, not per-project), and points git's global core.hooksPath at Guard's pre-commit scanner (skipped, with clear instructions instead, if you already have a global git hook set up for something else — it won't silently override it). Safe to re-run any time. Restart any already-running Claude Code session afterward to pick it up.

Note: this is "on by default for you," not "cannot be turned off" — you can still edit ~/.claude/settings.json yourself if you want to. For an org-wide guarantee a developer genuinely can't disable, see the Pro-tier centrally managed policy instead.

What it actually does

| Layer | What it catches | Guarantee | |---|---|---| | safe_read / safe_write MCP tools | Any file the agent chooses to read through Guard | Real values never enter the agent's context — this is the redaction layer | | Claude Code PreToolUse hook | A raw Read/Edit/Write/Bash call on a sensitive path, bypassing Guard entirely | Model can't reason around it — runs outside the model, on Claude Code. Best-effort only for Bash (see app/hooks/README.md) | | Cursor Hooks (beforeReadFile / beforeShellExecution) | Same as above, on Cursor | Model can't reason around it for reads — blocks the raw read and redirects to safe_read (see app/hooks/cursor/README.md for how this differs in shape from the Claude Code hook). Best-effort only for shell commands | | git pre-commit scanner | A secret that made it into a file anyway, about to be committed | Courtesy layer — --no-verify bypasses it by design | | Org policy (Pro) | A developer disabling the hook locally | Centrally managed via Claude Code's managed-settings.json — see doc/06_org_admin_setup.md |

Detection covers 127+ patterns (API keys, private keys, connection strings, cloud credentials, PII, financial data) plus an entropy-based fallback for unknown high-entropy secrets that don't match a known format. See app/resources/rules_v2.json for the full, current list.

Tools exposed

• safe_read(path) / safe_write(path, content) — the core redact-on-read, restore-on-write round trip. A write referencing a token the session doesn't recognize is blocked, not warned about.
• safe_search(searchPath, pattern, ...) — grep across a directory with matches tokenized the same way.
• guard_status() — license tier, loaded rules version, custom rule pack status, session token count.
• update_rules(sourcePath) — import a new signed rule set (Ed25519 verified, no unsigned bypass).
• load_custom_rules(sourcePath?) (Pro) — layer your own detection rules (internal ticket formats, internal hostnames, whatever the bundled set doesn't know) on top — see doc/07_custom_rule_packs.md.
• upgrade_trial(email) — one-click 6-month Pro trial, no email verification step.
• audit_log_tail(limit?) — locally-logged events, metadata only, AES-256-GCM encrypted at rest.

Community vs. Pro

| | Community | Pro | |---|---|---| | Activation | Automatic, offline | One-click trial, then paid | | Sessions | Capped | Unlimited | | Rule set | Core patterns | Full set, incl. generic credential detection | | Custom rule packs | — | ✅ | | Audit log export | — | ✅ | | Centrally managed org policy | — | ✅ |

Guard's core detection is free — the governance/compliance layer (org policy, audit export, custom rule packs) is what's monetized. See doc/02_objective_and_plan.md for the full reasoning.

Security model, honestly stated

• Guard's detection (regex + entropy) has an inherent false-negative rate — no pattern-matching approach is a guarantee. It's the day-to-day layer, not the only layer.
• The PreToolUse hook is a real, model-can't-override guarantee for file tools on Claude Code specifically. Cursor now has a comparable model-independent mechanism too — its Hooks feature (confirmed against Cursor 3.17.8, see app/hooks/cursor/README.md) — but the enforcement shape differs: Cursor's hook can only block a raw read and redirect to safe_read, it can't substitute redacted content in place the way the Claude Code path effectively does. Both give the agent no route to plaintext outside Guard, but describe them accurately, not as identical mechanisms. Codex still has no equivalent mechanism today — Guard on Codex relies on the model choosing to call safe_read/safe_write, which is materially weaker.
• Nothing here is a full corporate DLP suite, and it doesn't police model output — only what goes into the model from local files.

Docs

Start with doc/01_architecture.md and doc/02_objective_and_plan.md. Everything else in doc/ is numbered in build order; process.log has the full, session-by-session build and verification history if you want to see exactly what was tested and what's still an open gap.

Contributing

See CONTRIBUTING.md. Security issues: see the "Reporting a security issue" section there — please don't file those as public GitHub issues.

License

Free to use, not open source — see LICENSE for the full terms. In short: install and run it, personally or commercially, at no cost; modifying, redistributing, reselling, or reverse-engineering it isn't permitted without VaultMorph's written permission. (Versions 0.2.0–0.2.2 were previously published under the MIT License and remain governed by those original terms; this applies from 0.3.0 onward.)

Maintained by VaultMorph — [email protected].