Use cases

How teams typically deploy VaultRun. These are reference patterns — not named customer case studies — based on the product’s real capabilities (sandboxes, MCP, CI runner, Enterprise SSO).

Want a walkthrough on your infra? Propose call times or see the 2–3 min demo script.

01 / platform engineering

Shared sandbox platform for AI agents

Problem. Agents need to run untrusted code and touch files. Letting them loose on shared VMs or developer laptops creates blast-radius and audit gaps.

Pattern. One VaultRun API per environment. Agents create a session, upload tools/scripts via API or MCP, run commands in an isolated container, then tear down. Network stays off unless explicitly allowlisted.

API keys for agents; Enterprise SSO for humans on the dashboard
HMAC-signed audit trail for every session/run/file action
OPA hooks for command and path policy

Outcome. A controlled execution plane that stays on your network — no SaaS telemetry, no third-party code runner.

02 / regulated / security-minded AI

Agent access to data and cloud without ambient credentials

Problem. Giving an LLM toolchain raw AWS/DB credentials is risky; banning tools blocks useful workflows.

Pattern. Use MCP tools with explicit opt-in (e.g. AWS tools only when enabled), scoped filesystem allowlists, and Secrets Manager / Vault injection per run — results redacted in audit where needed.

53 MCP tools over stdio (Claude) or HTTP (OpenAI / OpenRouter / custom)
Postgres / SQLite / Mongo tools without putting the agent on the database host
Enterprise IdP login so dashboard users never share the master key

Outcome. Capability with a paper trail — suitable as an internal control story for security review.

03 / engineering / CI

PR tests inside an isolated VaultRun sandbox

Problem. CI runners that share state or host Docker sockets leak secrets and flake under load.

Pattern. Point a GitHub webhook at ci-runner. Each PR clones into a VaultRun session, runs your test command list, posts a PR comment + commit status, optionally Slack/Teams.

HMAC webhook validation
Token-safe clone via http.extraheader
Same security model as interactive agent sandboxes

Outcome. Homogeneous isolation for humans, agents, and bots.

get enterprise → schedule a walkthrough → clone the core