# VaultRun

> Self-hosted secure runtime for AI agents. Isolated Docker sandboxes, 53-tool MCP server (stdio + HTTP), HMAC-signed audit trail. Verify evidence + optional OpenJEV/Jev claim gates. Local-first: workflows stay assets on your infra. No SaaS, no telemetry.

VaultRun lets AI agents safely execute code, query databases, call cloud APIs, and manage files inside isolated Docker containers on your own infrastructure. Successful tool sequences can be saved as missions (verify checkpoints + sealed evidence export, optional OpenJEV/TypeSafe Jev gates, sandbox memory, swarm graph, cost attribution on replay). Apache 2.0 open core; Enterprise SSO (OIDC + SAML) is available separately.

## Start here

- [Website](https://vaultrun.dev/): Product overview and quickstart
- [Enterprise](https://vaultrun.dev/#enterprise): Evaluation, production license, or sales (emails mail@030.dev)
- [Enterprise one-pager](https://vaultrun.dev/enterprise.html): Procurement summary
- [Use cases](https://vaultrun.dev/use-cases.html): Reference deployment patterns
- [GitHub repository](https://github.com/nickvd7/vaultrun): Source, issues, releases
- [README](https://github.com/nickvd7/vaultrun/blob/main/README.md): Install, architecture, components
- [Changelog](https://github.com/nickvd7/vaultrun/blob/main/CHANGELOG.md): Release history (latest: v0.2.1)
- [Python SDK on PyPI](https://pypi.org/project/vaultrun-sdk/): `pip install vaultrun-sdk`

## Docs

- [Architecture](https://github.com/nickvd7/vaultrun/blob/main/docs/architecture.md): System design and components
- [Security model](https://github.com/nickvd7/vaultrun/blob/main/docs/security.md): Isolation, auth, audit, hardening
- [MCP server](https://github.com/nickvd7/vaultrun/blob/main/docs/mcp.md): 53 tools, stdio and HTTP transports
- [Configuration](https://github.com/nickvd7/vaultrun/blob/main/docs/configuration.md): Environment variables and options
- [SSO setup](https://github.com/nickvd7/vaultrun/blob/main/docs/sso-setup.md): OIDC and SAML (Enterprise)
- [CI runner](https://github.com/nickvd7/vaultrun/blob/main/docs/ci-runner.md): GitHub webhook → sandboxed CI
- [Flowd integration](https://github.com/nickvd7/vaultrun/blob/main/docs/flowd-integration.md): MCP bridge to local flowctl (opt-in)
- [Local inference gateway](https://github.com/nickvd7/vaultrun/blob/main/docs/local-gateway.md): OpenAI-compat action plane for Ollama / LM Studio / vLLM (SSE final answer, mission capture, [client recipes](https://github.com/nickvd7/vaultrun/blob/main/examples/local-gateway/README.md))
- [Verify checkpoints](https://github.com/nickvd7/vaultrun/blob/main/docs/features/verify-checkpoints.md): Post-run assertions (`exit_code_zero`, `stdout_contains`, `file_exists`)
- [Verify controls](https://github.com/nickvd7/vaultrun/blob/main/docs/features/verify-controls.md): Frozen pos/neg suite certifying the evaluator
- [Verify controls](https://github.com/nickvd7/vaultrun/blob/main/docs/features/verify-controls.md): Frozen pos/neg suite certifying the evaluator (v2 anti-shortcut)
- [OpenJEV / Jev](https://openjev.sh/): Opt-in claim-vs-evidence gates (see [use cases](https://vaultrun.dev/use-cases.html))
- [Agent plugin](https://github.com/nickvd7/vaultrun/blob/main/docs/plugin-publish.md): Cursor / Claude Code marketplace skill
- [OpenAPI](https://github.com/nickvd7/vaultrun/blob/main/docs/openapi.yaml): REST API schema
- [Roadmap](https://github.com/nickvd7/vaultrun/blob/main/docs/roadmap.md): Planned work

## SDKs & clients

- [Python SDK](https://github.com/nickvd7/vaultrun/tree/main/sdk/python): Typed client (`sandbox_sdk.Client`)
- [Go SDK](https://github.com/nickvd7/vaultrun/tree/main/sdk/go): Typed Go client
- [MCP server source](https://github.com/nickvd7/vaultrun/tree/main/sdk/mcp): Model Context Protocol implementation

## Quick facts for agents

- License: Apache-2.0 (core); Enterprise SSO commercial
- Language: Go 1.25+ (API/CLI/MCP); Next.js dashboard; Python + Go SDKs
- Sandbox: One Docker container per session; network off by default; non-root; capabilities dropped
- Auth: API keys (`vr_…`); optional OIDC/SAML via VaultRun Enterprise
- MCP: official Go SDK; 53 core tools (+6 Flowd when MCP_FLOWD_ENABLED); stdio or HTTP; Tasks (`async` / `tasks/get|update|cancel`, optional Redis); Apps; optional OAuth PRM
- Workflows: missions, verify checkpoints + controls + sealed evidence, optional OpenJEV/Jev claim gates, agent memory (`.vaultrun/memory/`), swarm graph, mission cost attribution — all self-hosted
- OpenJEV / claim gates: documented in product use cases; env flags land with the Jev integration release
- Install: `git clone https://github.com/nickvd7/vaultrun && cp .env.example .env && make up && make bootstrap-key`
- Bugs / features: https://github.com/nickvd7/vaultrun/issues/new/choose (use templates)
- Security: private only — https://github.com/nickvd7/vaultrun/blob/main/SECURITY.md
- Enterprise / sales: https://vaultrun.dev/#enterprise · mail@030.dev
- Flowd companion: https://vaultrun.dev/flowd.html · https://flowd.net

## Optional

- [Full llms.txt](https://vaultrun.dev/llms-full.txt): Longer product summary for grounding