VaultBridge

Secret management for AI coding agents. Your secrets never enter the LLM context window.

The Problem

• 29 million secrets were leaked on GitHub in 2025 (GitGuardian State of Secrets Sprawl), up 25% year-over-year

• AI-assisted commits leak secrets at 2x the baseline rate — autocomplete and agent workflows bypass the muscle memory that keeps developers from pasting keys into code

• 24,000+ secrets found in MCP config files — the new claude_desktop_config.json is the new .env committed to git

• Every secret in the LLM context window is sent to the AI provider's servers — even if the model never prints it, it was transmitted and processed

VaultBridge is an MCP server that gives AI agents access to your secrets without ever exposing the values. The agent sees metadata (names, services, env var mappings). The actual values flow through a side channel directly to their targets.

How It Works

┌─── Your Machine ────────────────────────────────────────────┐
│                                                              │
│   Claude Code / Cursor / Windsurf / AI Agent                 │
│       │                                                      │
│       │ MCP Protocol (tool calls)                            │
│       ▼                                                      │
│   ┌─────────────────────────────────────────────────┐        │
│   │  VaultBridge MCP Server                         │        │
│   │  ● Returns metadata only (names, IDs, mappings) │        │
│   │  ● Secret values NEVER in tool responses        │        │
│   └────────┬───────────────────────────┬────────────┘        │
│            │                           │                     │
│     MCP Tools                    Hook API (:9847)            │
│     (search, inject,             (capture, redact,           │
│      manifest, status)            check-value, redeem)       │
│            │                           │                     │
│            ▼                           ▼                     │
│   ┌─────────────────────────────────────────────────┐        │
│   │  Bitwarden CLI (bw / rbw)                       │        │
│   └────────────────────┬────────────────────────────┘        │
│                        │                                     │
│                        ▼                                     │
│   ┌─────────────────────────────────────────────────┐        │
│   │  Vaultwarden / Bitwarden Cloud (encrypted)      │        │
│   └─────────────────────────────────────────────────┘        │
│                                                              │
│   Hooks: auto-capture · redact · leak-prevent                │
└──────────────────────────────────────────────────────────────┘

Data flow: The agent calls vault_search and gets back names and IDs. When it needs a value, it calls vault_inject which writes directly to a .env file, clipboard, or template — the value never appears in the tool response. Hooks intercept secrets in shell output and file writes before they reach the LLM.

Quick Start

Prerequisites

• Runtime: Bun 1.0+ or Node.js 18+

• Vault CLI: Bitwarden CLI (bw) or rbw

• Vault backend: Vaultwarden (self-hosted) or Bitwarden cloud account

1. Install

Add to your Claude Code MCP config (~/.claude/settings.json):

{
  "mcpServers": {
    "vaultbridge": {
      "command": "bun",
      "args": ["run", "/path/to/vaultbridge-mcp-server/src/index.ts"],
      "env": {
        "BW_SESSION": "<your-bitwarden-session-key>",
        "BW_URL": "https://vault.example.com"
      }
    }
  }
}

2. Unlock your vault

# Bitwarden CLI
export BW_SESSION=$(bw unlock --raw)

# Or rbw
rbw unlock

3. Verify

Ask your agent: "Check vault status" — it will call vault_status and confirm the connection.

MCP Tools

Claude Code Hooks

VaultBridge ships with three hooks that form a defense-in-depth layer:

Hook configuration in .claude/settings.json:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{
          "type": "command",
          "command": "curl -s http://127.0.0.1:9847/api/check-value -d '{\"value\":\"$TOOL_OUTPUT\"}' | jq -r '.should_block'"
        }]
      }
    ]
  }
}

Configuration

See docs/configuration.md for the complete reference.

Security Model

What's protected

• Secret values never appear in MCP tool responses — the LLM cannot see them

• The Hook API runs on 127.0.0.1 only in stdio mode — no network exposure

• One-time redeem tokens expire in 10 seconds and are single-use

• Clipboard injection auto-clears after a configurable TTL (default 30s)

What's visible to the agent

• Secret metadata: names, IDs, service labels, project/environment tags, env var mappings

• Vault connection status (locked/unlocked, server URL, email)

• Injection confirmations (target type, file path — never the value)

Defense layers

1. MCP layer — Tools return metadata only; vault_inject writes to targets via side channel

2. Hook layer — post-bash scans output for secrets before the LLM sees it; pre-write blocks file writes containing secrets

3. Vault layer — All secrets encrypted at rest in Vaultwarden/Bitwarden; accessed via CLI with session authentication

4. Transport layer — HTTP mode requires Bearer token auth; stdio mode binds to localhost only

Comparison

vs Indie/Open-Source Projects

vs Enterprise Products

VaultBridge's niche: The only tool that combines Bitwarden integration + auto-capture + pre-LLM redaction + leak prevention in one system. AgentSecrets is the closest competitor but uses its own encrypted store and takes a network proxy approach instead of hooks.

Development

# Clone
git clone https://github.com/Code-for-100k/vaultbridge.git
cd vaultbridge

# Install dependencies
bun install

# Type check
bun run typecheck

# Run in stdio mode (local dev)
bun run start

# Run in HTTP mode
bun run start:http

# Build
bun run build

See CONTRIBUTING.md for the full development guide.

Architecture

VaultBridge operates as a 4-layer system:

1. Agent Layer — Claude Code / Cursor makes MCP tool calls

2. MCP Server Layer — Processes requests, enforces metadata-only responses

3. Hook Layer — Intercepts secrets in shell output and file writes

4. Vault Layer — Bitwarden CLI talks to encrypted storage

See docs/architecture.md for detailed diagrams and data flow documentation.

License

MIT - Copyright 2026 Code-for-100k Contributors