Vaultless Guard runs on each developer's machine, between the AI tool and the model provider. Watch the three-minute explainer, or follow one request through it below.
A developer asks Claude Code why a deploy fails. The agent reads .env, runs kubectl get secret and queries three customer rows. Everything it read is now part of the prompt: an AWS key, a database password, a customer's name and email.
The tool is pointed at the local gateway on 127.0.0.1 with one command (vguard clients configure claude --apply). No proxy in anyone's cloud, no TLS interception, no root, no certificate. The gateway reads every text field of the request: the prompt, files and command output the agent read, tool calls and their results, MCP traffic.
Credentials, personal data, internal hosts and your organisation's own terms are replaced with authenticated tokens like [VG1:1a2b3c4d:…]. Each token carries its value encrypted (AES-SIV) under a key that never leaves the machine and is bound to this conversation. There is no database mapping tokens to values, anywhere: that's what vaultless means. Oversized secret dumps are withheld, and content the gateway cannot inspect is refused rather than sent raw.
The model reasons about [VG1:…] the way it would about any identifier. The request that leaves your laptop, and anything logged on the provider side, holds tokens in place of every value the gateway recognised.
As the answer streams in, the gateway restores the real values on the developer's screen and in the agent's own tool calls, so the next command runs with the real key. Values are never restored into a URL, a link or an HTML attribute.
With guardrails on, a destructive tool call is stopped before it reaches your shell: rm -rf, terraform destroy, kubectl delete namespace, DROP TABLE, git push --force, reading SSH keys or cloud credentials, installing persistence. The agent sees why and can propose a safer path.
Each turn writes a hash-chained audit line: counts and categories, never content. Edit one line and vguard audit verify shows where the chain broke.
| To | What |
|---|---|
| Your AI provider | the request, with tokens in place of every value the gateway recognised |
| Your console (optional) | daily counts per data class and outcome, versions, health, self-test results, latency percentiles, the audit chain's head hash |
| Us | nothing, unless you use our hosted console, and then only the items above plus the accounts of the people who sign in to it |
vguard org telemetry prints the exact console payload on any machine.
The path from a trial code to the first protected request.
vguard org init on an administrator's machine and paste the organisation's public keycurl -fsSLo vguard-install.sh https://vguard.techmek.io/install.sh VGUARD_BUNDLE='vgb1.…' sh vguard-install.sh # from your enrolment vguard clients configure claude --apply # or: codex vguard guardrails status # then turn them on (below) vguard prove # see what the provider would receive
Turn guardrails on with guardrails: {enabled: true} in the policy (or an organisation-managed policy); the strict profile has them on. Undo routing any time with vguard clients configure claude --rollback. Fleets: push a managed profile with Jamf, Kandji or Intune.
On a long multi-agent Claude Code session (macOS, Apple Silicon), the gateway added 279 ms per turn at the median, about 4% of the turn, and 722 ms at p95. Repeated history is cached, and prompt caching keeps working because tokens are stable within a conversation.
vguard prove measures where you stand.vguard inventory reports them.