Vaultless Guard sits between Claude Code, Codex, Claude Desktop, every MCP tool and the model. Credentials, customer data and internal hosts are swapped for keyed tokens before a request leaves the laptop and swapped back when the answer arrives. Developers keep their tools. The provider sees tokens in place of every value the gateway detects.
vguard prove before every releaseContent is inspected where it is created, on the workstation. Across the boundary travel only three things: tokenized requests to the provider, counts and health to your console, and signed policy back. Pick a flow to follow it.
Every turn passes the same pipeline. Repeated history is answered from caches, so a long session pays for what is new, not for what came before.
Each of these has happened to real teams using AI agents. Each one is stopped on the machine, before anything reaches a provider.
An agent reads .env, a kubeconfig or a Terraform state. Keys and passwords become tokens; the agent still runs the command with the real value.
A database query or log returns names, emails, card numbers. The provider sees tokens; your engineer sees the rows.
A web page or README tells the agent to send secrets to a URL. Values are never restored into outbound calls after an injection is seen.
Dropping a database, force-pushing, deleting a namespace: action guardrails (when on) stop the call before the agent can run it.
A tool that quietly changes its description after approval is held until an owner re-approves it. Shadow MCP servers are refused.
A machine that stops routing, a gateway that stops protecting: the daily self-test and the fleet view say so before an auditor does.
A gateway hosted by a vendor has to see your prompts to protect them. That is one more copy of your data, in one more company. Vaultless Guard inspects where the data already is.
One package, one command. It routes Claude Code and Codex, wraps every MCP server, joins your organisation and proves it works. For fleets, your MDM does the same with a signed profile.
With the limits stated plainly, because a security product that overclaims is not one.
| Surface | How it is covered | Status |
|---|---|---|
| Claude Code: CLI, VS Code, JetBrains, Desktop Code tab | Routed through the gateway; the user's own Claude subscription or key is kept. IT can pin it with Claude Code's managed settings. | full |
| OpenAI Codex: CLI, IDE, app, ChatGPT agent | Routed with the ChatGPT sign-in kept. | full |
| MCP servers of every app | vguard clients mcp wrap: results protected, calls checked, changed tools held. | full |
| Company MCP used by cloud connectors | Published through vguard mcp-gateway at your edge. | full |
| Claude Desktop, whole app | Official gateway mode (API or cloud-provider billing). | full |
| Consumer chat apps on a personal subscription | Go to the vendor directly; govern with tenant restrictions. Their MCP tools stay protected. | not routable |
Controls mapped to these frameworks with evidence; not a certification.
Your console and our service receive versions, health, counts by category, the controls in force, and model names with token counts and estimated spend. Never:
Protect one machine in five minutes, or the whole fleet with your MDM.