Vaultshell runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 30 Sep 2026.
Injects secrets into shell commands at exec time; plaintext never reaches the LLM context
What the code does
We read the source, 6 d ago · rules ccca72095570
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const child = spawn(shell, ["-c", command], {
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Alternatives to Vaultshell
same job, measured the same wayA secret store for AI agents: the agent never sees the plaintext.
AI agents use your Obsidian secrets by name — values never reach their context.
Let AI agents use secrets without seeing them: inject into a command, redact the output.
Detect and redact PII and secrets before text reaches an LLM, with reversible placeholders.
Read-only access to secrets in a local KeePassXC vault. Runs commands with them injected.
Zero-knowledge MCP secrets vault for AI agents: secrets injected at runtime, never seen by the model
Detect hardcoded secrets in source and config. Reports masked previews, never the values.
Deterministic no-LLM MCP server that scrubs secrets before they reach an agent. Never leaks values.
Vaultshell — questions
Answers built from our own checks of this server.