claude-vault

The server employs a strong 'defense-in-depth' security model. It tokenizes all sensitive secret values before they reach the AI, ensuring zero-knowledge. All write operations and even file scanning operations require WebAuthn biometric or hardware key approval (human-in-the-loop), significantly mitigating prompt injection risks. Robust input validation is implemented to prevent command injection and path traversal attacks. Vault tokens are session-based, short-lived, and stored only in memory. A comprehensive local audit log tracks all operations. The local approval server runs on localhost by default, with clear instructions for securing it with HTTPS/Nginx in production. The primary risks are the user's responsibility: explicitly warning not to commit locally generated plaintext .env files or the temporary pending-operations.json file, and the initial 'curl | sudo bash' installation method common in Bash CLIs.