LLM Vault

Why

A coding agent reads files, environment variables and tool output, and it runs commands. If your OpenAI, Azure AI Foundry or Anthropic key sits in .env, one prompt injection hidden in a README is enough to send it to a stranger. Hiding the file does not help: whatever you can read, your agent can read.

LLM Vault changes the model from get_secret() to invoke_model(). The key stays in an encrypted KeePass-compatible vault, and the vault makes the call itself. Each agent, IDE or script gets a client token instead: a revocable permission to call the models you allowed, within a budget, with your approval.

"Use my permission to run an approved operation - but never show me the secret."

Video guides

Real recordings of the app, real HTTP responses, local models. Click a thumbnail to watch.

Shorts: My AI agent asked for my API key. Politely. · This script runs AI all night. No API key.

Playlists: LLM Vault - AI agents without API keys

Subscribe on YouTube: https://www.youtube.com/@bestin-it

Features

🔐 Password manager	KDBX 4.1 vault (AES-256, Argon2id 64 MiB, ChaCha20-protected fields, HMAC block integrity). Groups, logins, notes, password generator, clipboard auto-clear. Opens your KeePass / KeePassXC databases, and its files open in them.
🚪 LLM gateway	127.0.0.1:8765: OpenAI /v1/chat/completions (streaming, tool calls), Anthropic /v1/messages (Claude Code), /v1/embeddings, /v1/models. No endpoint returns a key, a password or the configuration.
🧩 38 integrations	Ollama (local + ollama.com), LM Studio, llama.cpp, vLLM, SGLang, OpenAI, Azure AI Foundry, Azure OpenAI, Anthropic, Gemini, OpenRouter, Groq, Mistral, DeepSeek, xAI and more - with model discovery and local server detection.
🎫 Client tokens	Per client: model allow-list, expiry, requests/minute, daily and monthly budget, one-click revoke. Stored as SHA-256 only.
✋ Consent	Ask every time, once per session, or pre-approve - with an anti-click-jacking arming delay on the buttons.
📊 Audit & analytics	Every call with its policy decision, tokens (input / output / cached), cost and latency. Usage is labelled reported, estimated or unavailable. CSV / JSON export.
👤 Profiles	Sign in with a user name and login password; several profiles per machine, each with its own vaults, audit log and settings. No password reset - by design.
🖥️ Desktop-first	One native executable (Rust + Slint). No Docker, no browser, no Python or Node runtime. llmvault-server runs the same gateway headless for the strong-isolation mode.

How it works

flowchart LR
    C["AI agent · Claude Code · Copilot Chat · Python script"] -- "client token lvk_…" --> G["LLM Vault gateway<br/>127.0.0.1:8765<br/>policy · consent · budget"]
    V[("KDBX 4.1 vault<br/>provider keys")] -. "key never leaves the vault process" .-> G
    G -- "HTTPS + provider key" --> P["OpenAI · Azure AI Foundry · Anthropic<br/>Ollama · llama.cpp · vLLM · 30+ more"]
    G --> A[("Audit log<br/>tokens · cost · decisions")]

1. The client sends a normal OpenAI- or Anthropic-style request with its token.
2. LLM Vault checks the token, the model allow-list, limits and budgets, and asks you if the policy says so.
3. The vault calls the provider with the key - the key exists only inside the vault process and the TLS request.
4. The client gets the answer; tokens, cost and the decision go to the audit log.

Download

Platform	Package	Where
Windows 10 1809+ / 11 (x64)	Installer (per-user, no admin) · portable ZIP · SHA-256 checksums	bestin-it.com/llm-vault
macOS · Linux	Build from source (below); DMG, AppImage, .deb and .rpm scripts are in packaging/	-

Installers are published on the project page only, not as GitHub release assets. Try it without any key: llmvault --demo opens an isolated vault with synthetic data.

Quick start

1. Install, create a profile, then create a vault (or open an existing .kdbx).
2. Providers - connect e.g. Ollama (local) (no key) or Azure AI Foundry (the key goes into the vault).
3. Clients & agents - create a token per agent, IDE or script. It is shown once, with ready snippets.
4. Point the client at the vault:

# Python - OpenAI SDK: only the base URL and the "key" change
import os
from openai import OpenAI
client = OpenAI(base_url="http://127.0.0.1:8765/v1", api_key=os.environ["VAULT_CLIENT_TOKEN"])
print(client.chat.completions.create(model="qwen-local",
      messages=[{"role": "user", "content": "Review this diff"}]).choices[0].message.content)

# Claude Code - Anthropic Messages API on /v1/messages
$env:ANTHROPIC_BASE_URL   = "http://127.0.0.1:8765"
$env:ANTHROPIC_AUTH_TOKEN = "lvk_..."        # vault token, not an Anthropic key
$env:ANTHROPIC_MODEL      = "qwen-local"     # alias defined in LLM Vault
claude

More: VS Code GitHub Copilot Chat (Custom Endpoint) · Claude Code · Python · curl · custom Copilot agent · scripts from the videos

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗