Let AI agents run code — without handing them your machine.

Why

Agents that can act need somewhere safe to act.

Once an agent can run commands, the question isn't whether it will run something it shouldn't — it's what happens when it does.

How it works

One API between your agent and the blast radius.

Your agent calls VaultRun instead of a shell. VaultRun decides, isolates, runs and records.

Quickstart

Running locally in five minutes.

Pick how you want to start. Everything runs on your machine; nothing phones home.

git clone https://github.com/nickvd7/vaultrun
cd vaultrun
cp .env.example .env   # set MASTER_API_KEY
make up                # API + Postgres + Redis + dashboard
make bootstrap-key     # prints your first vr_… key
curl http://localhost:8080/health
{"status":"ok"}
# dashboard → http://localhost:3000

# pip install vaultrun-sdk
from sandbox_sdk import Client

client = Client("http://localhost:8080", api_key="vr_…")
s = client.create_session(image="python:3.12-slim")
client.upload_file(s.id, "script.py", open("script.py", "rb"))
r = client.run(s.id, command="python", args=["script.py"])
print(r.stdout)

import (
    "fmt"
    vaultrun "github.com/nickvd7/vaultrun/sdk/go"
)

client := vaultrun.New("http://localhost:8080", "vr_…")
s, err := client.CreateSession(ctx, vaultrun.CreateSessionOptions{
    Image: "python:3.12-slim"})
if err != nil { return err }
run, err := client.Run(ctx, s.ID, vaultrun.RunOptions{
    Command: "python", Args: []string{"script.py"}})
if err != nil { return err }
if run.Stdout != nil { fmt.Println(*run.Stdout) }

{
  "mcpServers": {
    "vaultrun": {
      "command": "/path/to/vaultrun-mcp",
      "env": {
        "VAULTRUN_BASE_URL": "http://localhost:8080",
        "VAULTRUN_API_KEY": "vr_your_key"
      }
    }
  }
}

Security model

Paranoid defaults. Honest limits.

Here's what VaultRun protects against, and where you should add more isolation.

MCP server

53+ tools. Two transports. Any agent.

Paste one snippet into Claude Desktop or Cursor, or run the HTTP transport for OpenAI and custom agents. Click a group to see its tools.

{
  "mcpServers": {
    "vaultrun": {
      "command": "/path/to/vaultrun-mcp",
      "env": {
        "VAULTRUN_BASE_URL": "http://localhost:8080",
        "VAULTRUN_API_KEY": "vr_your_key"
      }
    }
  }
}

MCP_TRANSPORT=http \
MCP_AUTH_TOKEN=your-secret-token \
VAULTRUN_BASE_URL=http://localhost:8080 \
VAULTRUN_API_KEY=vr_your_key \
./vaultrun-mcp
# POST /mcp — JSON-RPC 2.0, Bearer your-secret-token

Local AI

Ollama thinks. VaultRun acts.

Point Open WebUI, Continue or any OpenAI-compatible client at vaultrun-local. Chat goes to your local model; tool calls run in a sandbox. Optional mission capture and OpenJEV completion gates when a loop claims it is done.

Open WebUI / Continue  →  vaultrun-local  →  Ollama / LM Studio / vLLM
                              │ tool_calls
                              ▼
                       VaultRun sandbox
                       run · files · audit

Gateway docs ↗

Where it fits

Self-hosted, on purpose.

Hosted sandbox APIs are great when your data can leave. VaultRun is for when it can't.

Beyond the sandbox

More in the repo.

Built on the same API, documented separately.

Open core

Apache 2.0 core. SSO when your team needs it.

Everything above is open source. VaultRun Enterprise adds OIDC and SAML single sign-on with org-aware roles. Evaluation is free.

Request evaluation Enterprise one-pager →

Contact

Talk to us.

Bugs and feature requests go to GitHub Issues. Everything else, here.

Privacy

Privacy statement

The contact form on this site is processed by FormSubmit and delivered to mail@030.dev. We use the information you send only to respond to your request. We do not sell personal data. VaultRun software itself does not phone home and collects no product telemetry. For security reports, use SECURITY.md instead of the form.