io.github.SoWhatI/vaultshell

vaultshell

English | 简体中文

Available on the official MCP Registry: io.github.SoWhatI/vaultshell

An MCP server that stores secrets in local secure storage, injects them into shell child processes at exec time based on rules, and guarantees secret plaintext never reaches the model context — not in tool responses, not in logs, not in audit records.

The closed loop: reference-based storage + conditional injection + mandatory output redaction.

Status: M3 — one-shot commands + persistent sessions + credential proxy + external CLI backends. See CHANGELOG and docs/design-spec.md.

The iron rule

• No MCP tool returns secret plaintext — ever. Responses contain only names, masks ([REDACTED:NAME]), and redacted output.
• Resolvers are only invoked inside the launcher; values go straight into the child process env and never pass through the tool layer.
• shell_exec has no free-form env parameter. Secrets enter by rule reference only.
• Redactor failures are fail-closed: output is discarded, never returned raw.

Quick start

Requires Node.js 20+.

Install from GitHub (no npm registry account needed)

# Run on demand directly from the repo (npm installs devDependencies and
# builds dist/ via the `prepare` script):
npx -y github:SoWhatI/vaultshell

# Or install globally:
npm i -g github:SoWhatI/vaultshell

This is the same code as the npm registry package, installed from git — npm clones the repo, runs prepare (→ npm run build) and links the vaultshell bin. Pin a tag for reproducibility: npx -y github:SoWhatI/vaultshell#v0.1.1.

Docker (ghcr.io)

docker run -i --rm \
  -e MASTER_KEY=<64 hex chars> \
  -v ~/.vaultshell:/home/node/.vaultshell \
  ghcr.io/sowhati/vaultshell:latest

MCP client config using Docker:

{
  "mcpServers": {
    "vaultshell": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MASTER_KEY=<64 hex chars>",
        "-v", "~/.vaultshell:/home/node/.vaultshell",
        "ghcr.io/sowhati/vaultshell:latest"
      ]
    }
  }
}

The image runs as the non-root node user (HOME=/home/node), so the data volume mounts at /home/node/.vaultshell. node-pty is excluded from the image — sessions automatically fall back to pipe mode (pty: false) in containers; injection and redaction are unchanged. The web subcommand passes through (docker run … ghcr.io/sowhati/vaultshell web — loopback inside the container, of limited use).

No Smithery distribution: Smithery has gone hosted-only (it only accepts servers deployed to its own infrastructure). vaultshell's secrets must stay on the user's machine by design — third-party hosting is incompatible with its threat model, so we deliberately do not publish there.

From source

# Run via npx (after publish) or from source:
npm install && npm run build

# 1. Create a master key for the encrypted-file backend
export MASTER_KEY=$(openssl rand -hex 32)

# 2. Create ~/.vaultshell/config.yaml and ~/.vaultshell/rules.yaml
#    (full annotated examples: docs/user-guide.md)

# 3. Store a secret (never echoed back) and run with injection
#    via your MCP client's tools: secret_set, then shell_exec

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "vaultshell": {
      "command": "npx",
      "args": ["-y", "vaultshell"],
      "env": { "MASTER_KEY": "<64 hex chars>" }
    }
  }
}

Full setup, configuration reference, rule-writing guide, client integration, and FAQ: docs/user-guide.md.

MCP tools

Execution limits (M3)

• dryRun: true on shell_exec reports the would-be ruleId, injected names, final env key list (never values) and the deny-list verdict — without executing anything.
• timeoutSeconds (default defaults.execTimeoutSeconds = 120, capped at
  1. kills the command and returns timedOut: true.
• defaults.maxOutputBytes (default 1 MiB) truncates each output stream and sets truncated: true. Truncation happens after the Redactor — it can never bypass redaction.
• defaults.maxConcurrentExecs (default 8) rejects excess concurrent shell_exec calls with a clear error (no queue).
• All of the above are recorded in the audit log (dryRun / timedOut / truncated flags).

Web config UI

vaultshell web            # loopback-only HTTP UI on a random port
vaultshell web --port 5317

Prints a one-time-token URL like http://127.0.0.1:5317/?token=… — open it to manage secrets (write-only), edit rules with live static-validation warnings and a matcher dry-run, edit config, and browse the redacted audit log. The token dies with the process; every API call needs it, mutations require same-origin application/json requests, and no endpoint can ever return a secret value. Do not port-forward it. Design & threat model: docs/web-config-ui-design.md.

Credential proxy (M3)

For high-sensitivity API tokens, prefer not landing the secret in env at all. Declare a proxy in config.yaml:

proxies:
  - id: stripe
    upstreamHost: https://api.stripe.com
    secretRef: STRIPE_KEY                          # registry name or full ref
    headerTemplate: "Authorization: Bearer ${value}"

Then shell_proxy_start { "id": "stripe" } → { port, expiresAt }, and commands call http://127.0.0.1:<port>/v1/charges instead of https://api.stripe.com/v1/charges. The proxy injects the header in memory only and auto-stops after its TTL (default 300s). Audit records the host and secret name, never the header value.

Boundaries: http:///https:// upstreams only (proxy→upstream TLS is properly validated; no CONNECT tunneling, no TLS termination); the client→proxy leg is plaintext on 127.0.0.1, which inherits the same-UID local-process boundary from the threat model.

Persistent sessions (M2)

shell_session_open spawns a long-lived shell with the matched rule's secrets injected at creation. The session is recycled after an idle TTL (defaults.sessionTtlSeconds, default 900s, overridable per rule via ttlSeconds or per call) — when the process dies, the secrets die with it. shell_session_revoke kills a possibly-compromised session immediately and rebuilds one without any secrets.

Sessions use a real PTY via node-pty (an optional dependency — native build, needs Xcode CLT on macOS / build-essential + python3 on Linux). If node-pty cannot be loaded or spawned, vaultshell automatically falls back to a plain child_process shell and the shell_session_open response says pty: false; injection and redaction behave identically, only interactivity is degraded. Session output merges stdout/stderr (PTY semantics) and passes through the same Redactor.

Backend support matrix

Details, per-backend setup, and how to register a plugin resolver: docs/backends.md.

Threat model

Full discussion: docs/design-spec.md §7. Report vulnerabilities privately per SECURITY.md.

Data layout

~/.vaultshell/
  config.yaml     # main config
  rules.yaml      # injection rules + secret refs (refs only, never values)
  secrets.enc     # encrypted-file backend (0600)
  audit/          # JSONL audit, redacted

VAULTSHELL_HOME overrides the data directory (used by tests).

Development

npm run build   # tsc
npm test        # vitest — redactor property tests, backend round-trips,
                # rule matching, shell_exec end-to-end

See CONTRIBUTING.md — including the security red lines every PR must respect.

License

MIT © 2026 vaultshell contributors