Why
A coding agent reads files, environment variables and tool output, and it runs commands. If your OpenAI,
Azure AI Foundry or Anthropic key sits in .env, one prompt injection hidden in a README is enough to send
it to a stranger. Hiding the file does not help: whatever you can read, your agent can read.
LLM Vault changes the model from get_secret() to invoke_model(). The key stays in an encrypted
KeePass-compatible vault, and the vault makes the call itself. Each agent, IDE or script gets a client token
instead: a revocable permission to call the models you allowed, within a budget, with your approval.
"Use my permission to run an approved operation - but never show me the secret."
Video guides
Real recordings of the app, real HTTP responses, local models. Click a thumbnail to watch.
Shorts: My AI agent asked for my API key. Politely. · This script runs AI all night. No API key.
Playlists: LLM Vault - AI agents without API keys
Subscribe on YouTube: https://www.youtube.com/@bestin-it
Features
| |
|---|
| 🔐 Password manager | KDBX 4.1 vault (AES-256, Argon2id 64 MiB, ChaCha20-protected fields, HMAC block integrity). Groups, logins, notes, password generator, clipboard auto-clear. Opens your KeePass / KeePassXC databases, and its files open in them. |
| 🚪 LLM gateway | 127.0.0.1:8765: OpenAI /v1/chat/completions (streaming, tool calls), Anthropic /v1/messages (Claude Code), /v1/embeddings, /v1/models. No endpoint returns a key, a password or the configuration. |
| 🧩 38 integrations | Ollama (local + ollama.com), LM Studio, llama.cpp, vLLM, SGLang, OpenAI, Azure AI Foundry, Azure OpenAI, Anthropic, Gemini, OpenRouter, Groq, Mistral, DeepSeek, xAI and more - with model discovery and local server detection. |
| 🎫 Client tokens | Per client: model allow-list, expiry, requests/minute, daily and monthly budget, one-click revoke. Stored as SHA-256 only. |
| ✋ Consent | Ask every time, once per session, or pre-approve - with an anti-click-jacking arming delay on the buttons. |
| 📊 Audit & analytics | Every call with its policy decision, tokens (input / output / cached), cost and latency. Usage is labelled reported, estimated or unavailable. CSV / JSON export. |
| 👤 Profiles | Sign in with a user name and login password; several profiles per machine, each with its own vaults, audit log and settings. No password reset - by design. |
| 🖥️ Desktop-first | One native executable (Rust + Slint). No Docker, no browser, no Python or Node runtime. llmvault-server runs the same gateway headless for the strong-isolation mode. |
How it works
flowchart LR
C["AI agent · Claude Code · Copilot Chat · Python script"] -- "client token lvk_…" --> G["LLM Vault gateway<br/>127.0.0.1:8765<br/>policy · consent · budget"]
V[("KDBX 4.1 vault<br/>provider keys")] -. "key never leaves the vault process" .-> G
G -- "HTTPS + provider key" --> P["OpenAI · Azure AI Foundry · Anthropic<br/>Ollama · llama.cpp · vLLM · 30+ more"]
G --> A[("Audit log<br/>tokens · cost · decisions")]
- The client sends a normal OpenAI- or Anthropic-style request with its token.
- LLM Vault checks the token, the model allow-list, limits and budgets, and asks you if the policy says so.
- The vault calls the provider with the key - the key exists only inside the vault process and the TLS request.
- The client gets the answer; tokens, cost and the decision go to the audit log.
Download
| Platform | Package | Where |
|---|
| Windows 10 1809+ / 11 (x64) | Installer (per-user, no admin) · portable ZIP · SHA-256 checksums | bestin-it.com/llm-vault |
| macOS · Linux | Build from source (below); DMG, AppImage, .deb and .rpm scripts are in packaging/ | - |
Installers are published on the project page only, not as GitHub release assets.
Try it without any key: llmvault --demo opens an isolated vault with synthetic data.
Quick start
- Install, create a profile, then create a vault (or open an existing
.kdbx).
- Providers - connect e.g. Ollama (local) (no key) or Azure AI Foundry (the key goes into the vault).
- Clients & agents - create a token per agent, IDE or script. It is shown once, with ready snippets.
- Point the client at the vault:
# Python - OpenAI SDK: only the base URL and the "key" change
import os
from openai import OpenAI
client = OpenAI(base_url="http://127.0.0.1:8765/v1", api_key=os.environ["VAULT_CLIENT_TOKEN"])
print(client.chat.completions.create(model="qwen-local",
messages=[{"role": "user", "content": "Review this diff"}]).choices[0].message.content)
# Claude Code - Anthropic Messages API on /v1/messages
$env:ANTHROPIC_BASE_URL = "http://127.0.0.1:8765"
$env:ANTHROPIC_AUTH_TOKEN = "lvk_..." # vault token, not an Anthropic key
$env:ANTHROPIC_MODEL = "qwen-local" # alias defined in LLM Vault
claude
More: VS Code GitHub Copilot Chat (Custom Endpoint) ·
Claude Code · Python · curl ·
custom Copilot agent ·
scripts from the videos
This is the beginning of the README. Read the rest at the original. Read the full README ↗
