Vultrino

A credential proxy for the AI era — enabling AI agents to use credentials without seeing them.

What is Vultrino?

Vultrino is a credential proxy that keeps raw credential fields out of the agent-facing API and injects authentication inside trusted connectors. Instead of giving an agent an API key, you give it a credential alias and an action surface.

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│   AI Agent      │────▶│    Vultrino     │────▶│   External API  │
│   (Claude, etc) │     │   (injects auth)│     │   (GitHub, etc) │
└─────────────────┘     └─────────────────┘     └─────────────────┘
        │                       │
        │ "Use github-api       │ Authorization: Bearer ghp_xxx...
        │  credential"          │
        ▼                       ▼
   Alias-only request     Handles authentication

Features

• Credential Isolation — agent-facing schemas carry aliases and confined responses, not raw credential fields
• Role-Based Access Control — Fine-grained permissions with credential scoping
• Multiple Credential Types — API keys, Basic Auth, OAuth2 (with automatic token refresh), and extensible via plugins
• OAuth2 Support — Client credentials and refresh token flows with automatic token refresh
• Scoped API Keys — Restrict which credentials each API key can access using glob patterns
• Plugin System — Extend with custom credential types and actions via WASM plugins
• MCP Integration — Native Model Context Protocol support for LLM tools
• Metered LLM Proxy — Point any OpenAI/Anthropic-compatible client's base_url at Vultrino with a Vultrino key instead of the provider key; the real model key stays in the vault and token spend is metered. Supports incremental SSE streaming (stream: true) with on-the-fly secret scrubbing.
• Use Tokens — Single-use or time-scoped grants that let an agent perform one specific action
• Action Approvals — Human-in-the-loop sign-off (admin panel, Telegram, or webhook/email) before an action runs
• Web UI — Clean admin interface for managing credentials, roles, and API keys
• Encrypted Storage — AES-256-GCM encryption with Argon2 key derivation
• Policy Engine — URL patterns, method restrictions, rate limiting
• Usage Events: credential use and admin changes are recorded as events in the event outbox (replayable with GET /api/v1/events) and in structured logs. A durable audit-log file and a working web Audit Log page are not implemented yet (see LIMITATIONS).

Installation

Requirements

• Rust 1.96.0 (pinned in rust-toolchain.toml; rustup installs it)
• No system OpenSSL packages — TLS uses rustls

From Source

git clone https://github.com/FeirAI/vultrino.git
cd vultrino
cargo build --release --locked
cp target/release/vultrino ~/.local/bin/

Release binaries / Docker

Tagged releases (v*) publish platform archives and a container image:

# Binary (example: Apple Silicon)
curl -L https://github.com/FeirAI/vultrino/releases/latest/download/vultrino-aarch64-apple-darwin.tar.gz | tar xz
sudo mv vultrino /usr/local/bin/

# Container
docker pull ghcr.io/feirai/vultrino:latest

See Installation for Linux/macOS variants.

Quick Start

1. Initialize Storage

# Create config.toml and the web UI admin login (interactive; `vultrino web` refuses to start without the login)
vultrino init

# Set your encryption password
export VULTRINO_PASSWORD="your-secure-password"

# Add your first credential
vultrino add --alias github-api --key ghp_your_token_here

2. Make Authenticated Requests

# Make a request using the credential
vultrino request github-api https://api.github.com/user

3. Start the Web UI

# Required by `vultrino web` (it refuses to start without it): a stable secret, kept the same across restarts
export VULTRINO_POLICY_HASH_SECRET="<stable random secret>"

# Start the admin interface
vultrino web

# Open http://127.0.0.1:7879 in your browser

4. Use with AI Agents (MCP)

# Start MCP server for LLM integration
vultrino serve --mcp

This is the beginning of the README. Read the rest at the original. Read the full README ↗