Use cases

How teams typically deploy VaultRun. These are reference patterns — not named customer case studies — based on the product’s real capabilities (sandboxes, MCP, local inference gateway, CI runner, Enterprise SSO).

01 / platform engineering

Shared sandbox platform for AI agents

Problem. Agents need to run untrusted code and touch files. Letting them loose on shared VMs or developer laptops creates blast-radius and audit gaps.

Pattern. One VaultRun API per environment. Agents create a session, upload tools/scripts via API or MCP, run commands in an isolated container, then tear down. Network stays off unless explicitly allowlisted.

• API keys for agents; Enterprise SSO for humans on the dashboard
• HMAC-signed audit trail for every session/run/file action
• OPA hooks for command and path policy

Outcome. A controlled execution plane that stays on your network — no SaaS telemetry, no third-party code runner.

02 / regulated / security-minded AI

Agent access to data and cloud without ambient credentials

Problem. Giving an LLM toolchain raw AWS/DB credentials is risky; banning tools blocks useful workflows.

Pattern. Use MCP tools with explicit opt-in (e.g. AWS tools only when enabled), scoped filesystem allowlists, and Secrets Manager / Vault injection per run — results redacted in audit where needed.

• 71 MCP tools over stdio (Claude) or HTTP (OpenAI / OpenRouter / custom)
• Postgres / SQLite / Mongo tools without putting the agent on the database host
• Enterprise IdP login so dashboard users never share the master key

Outcome. Capability with a paper trail — suitable as an internal control story for security review.

03 / engineering / CI

PR tests inside an isolated VaultRun sandbox

Problem. CI runners that share state or host Docker sockets leak secrets and flake under load.

Pattern. Point a GitHub webhook at ci-runner. Each PR clones into a VaultRun session, runs your test command list, posts a PR comment + commit status, optionally Slack/Teams.

• HMAC webhook validation
• Token-safe clone via http.extraheader
• Same security model as interactive agent sandboxes

Outcome. Homogeneous isolation for humans, agents, and bots.

04 / platform / workflows

Workflow-as-asset: save, verify, replay

Problem. Agent wins live in ephemeral chats. Teams cannot re-run a proven plan, prove what passed, or attribute spend to a named workflow.

Pattern. Capture successful tool sequences as VaultRun missions on your infra. Attach verify checkpoints after runs, export sealed evidence digests when you need a portable proof, keep agent notes in sandbox memory, optionally describe swarm edges for multi-agent sessions, and snapshot cost attribution when you replay.

• Missions API — named, versioned steps you own
• Verify — exit / stdout / file assertions, anti-shortcut control suite, sealed evidence export
• Local-first — no SaaS; audit + assets stay on your network

Outcome. Workflows become inspectable assets with exportable proof, not disposable transcripts.

05 / local AI

Local models that can act — without a SaaS runner

Problem. Ollama / LM Studio can chat. Giving them shell or tools on the host is an open blast radius; shipping execution to a cloud sandbox fights the reason you went local.

Pattern. Run vaultrun-local as an OpenAI-compatible gateway. Clients (Open WebUI, Continue, LiteLLM) talk to your local model; tool calls execute in VaultRun sandboxes. Successful loops can auto-capture as missions.

• Model stays local; actions stay sandboxed on your infra
• Network off by default; signed audit on every tool call
• Recipes for Open WebUI / Continue / LiteLLM in examples/local-gateway/

Outcome. Local AI with a controlled action plane — think local, act contained.

06 / verify / evidence

Stop agents from declaring victory without evidence

Problem. Agents narrate success. Deterministic checks catch missing files and bad exits, so wire them in instead of trusting the agent’s own summary.

Pattern. Run VaultRun verify checkpoints after each run → export sealed evidence (verify_evidence) → accept “done” only when the checkpoints pass.

• Evidence from sandboxes you own — digests + optional HMAC
• Assertions on exit code, stdout and files — no model in the loop
• MCP, API, and local-gateway surfaces

Outcome. Completion only when the checks pass — not when the model sounds confident.