The agent asks.
You decide.
The record proves it.

Four channels, one policy, one verdict

An agent has four ways to touch your machine. AgentVault sits on all four, evaluates every request against the same rules, and writes the outcome to the same log. Deny by default: nothing runs unless a rule says it may.

One file, every agent

Vendor sandboxes each speak their own permission dialect, and only protect their own agent. AgentVault reads one declarative policy — the same file whether the request arrives from Claude Code, OpenCode, or a bash script — so you write rules once and get one approval inbox and one log across all of them.

version: 1

defaults:
  action: deny                # unmatched = nothing runs
  approval_timeout: 60s

rules:
  - name: protect-credentials
    match:
      action: [fs.read, fs.write, fs.delete]
      path: ["~/.ssh/**", "~/.aws/**", "~/.config/gcloud/**"]
    effect: deny
    message: "Credential paths are off-limits to agents."

  - name: git-push-ask
    match:
      action: [shell.exec]
      cel: 'event.cmd == "git" && event.argv[1] == "push"'
    effect: require_approval
    message: "Pushing code requires your approval."

  - name: workdir-is-free
    match: {action: [fs.read, fs.write], path: ["./**"]}
    effect: allow

approvals:
  timeout: 60s
  channels:
    tty:
      enabled: true
    macos:
      enabled: true
    telegram:
      enabled: true
      bot_token_env: AGENTVAULT_TELEGRAM_TOKEN
      chat_id_env: AGENTVAULT_TELEGRAM_CHAT_ID

Approvals reach you, not the terminal you forgot about

A rule that says require_approval can page you on any of three channels at once. Each shows the rule that fired, the exact command and the directory it acts in — the two remote ones also show the moment the request expires, so you are never guessing what a yes covers.

What ran, what was refused, and proof nobody edited it

Every request becomes a row: action, verdict, the rule that decided it, how long it waited. Rows are hash-chained in local SQLite, and the chain head is Ed25519-signed when the session closes with a key that is then destroyed. agentvault verify reports OK — or tells you exactly where the chain broke.

103 attacks, executed for real

A sandbox that blocks nothing is easy to spot. A sandbox that blocks almost nothing is not — so the corpus runs 103 distinct attack variants under every sandbox installed on the host, and each variant is first proven to succeed with no sandbox. Otherwise the block is theatre.

13 destructive · 52 credential-theft · 10 exfiltration · 16 evasion · 12 persistence. Reproduce it: make corpus, or go test -v -run TestCompareMatrix ./test/redteam/.

Reading the columns honestly: srt (what Claude Code sandboxes with) ties AgentVault at 103/103 — and §06 shows what that tie costs. Codex CLI’s default profile blocks all network exfiltration and out-of-workspace persistence, but allows full-disk reads and any write inside your project: that is a deliberate trade-off, not a bug — it just puts credential theft and rm -rf of your working tree outside its default threat model. Docker with a writable bind mount is not a sandbox; every filesystem attack landed. OpenCode has no OS-level sandbox at all, so it is the no-sandbox column once a command is approved.

Security that stops the work gets switched off

“Attacks blocked” is a gameable number: deny everything and you score 100%. So the same run measures eight everyday operations an agent must perform to be useful — read a file, edit it, build, commit, push, fetch a package — under the same tools with the same defaults.

AgentVault passes git push and network egress to require_approval instead of a static deny — in this battery the harness auto-approves, the scripted equivalent of tapping Allow on your phone. srt’s zero-config default has no approval channel to escalate to, so writes and egress simply fail.

Use the vendor sandbox. Until you need the rest

If you run exactly one agent, never leave it unattended, and don’t need to prove what it did — use the sandbox built into your agent. It’s free, zero-install and good. AgentVault is for what comes after that: more than one agent, an unattended run, and an audit trail anyone can check.

The parts that aren’t true yet

Security tools die on overclaiming, so the gaps go on the landing page rather than in a footnote three clicks away. The red-team battery prints these as KNOWN GAP rows instead of hiding them.

Wrap something and watch it get refused

# install, then write a policy and install the shims
$ curl -fsSL https://raw.githubusercontent.com/aashish254/agentvault/main/scripts/install.sh | sh
$ agentvault init
$ agentvault policy check                      # validate before you rely on it

$ agentvault run -- bash                       # wrap anything: a shell, claude, opencode
inside:  rm -rf /tmp/x       → blocked (exit 126), rule named
inside:  git push            → your phone pings: allow once / allow rule / deny

$ agentvault log                               # live TUI: action, verdict, rule, latency
$ agentvault verify                            # prove nobody edited the log