AgentVault: product and architecture
This AgentVault review covers the open-source project at github.com/hugoventures1-glitch/agentvault: a small, MIT-licensed security layer that wraps OpenClaw agents and watches what they do. Its README calls it "security infrastructure for AI agents - built in response to OpenClaw's documented vulnerabilities". We read the README and the repository file list on 2026-10-05; we did not run the software. The review covers how it works, who it suits, what it costs, where it falls short, and which tools to look at next to it. One note before we start: the agentvault.ai domain now belongs to a different company with a different product. Nothing on that site describes this project, and nothing from it is used here.
Overview
AgentVault is a developer project, not a company product. The repository has 6 commits, 2 stars and 0 forks, no tagged releases, and its last push was on 2026-02-10. The README's contributing note says "This is day 1. Issues and PRs welcome." The maker's launch description says it was built in 3 hours because the problem was urgent. Read the rest of this review with that in mind: this is an early, single-maintainer tool.
The problem it answers is OpenClaw security. The README states that OpenClaw collected 5 CVEs in 10 days (including remote code execution), 341 malicious marketplace skills and 42,000+ exposed instances with an authentication bypass. It cites research from Zenity, Penligent, CrowdStrike, Koi Security and Cisco Talos, including Penligent's write-up of CVE-2026-22708, an AWS credential theft.
Its central idea is that prompt injection cannot be solved at the model level, so the useful place to defend is the action that follows. In the README's words: "Let the prompt injection succeed, but catch what it tries to DO." In practice, this moves the defence from the prompt to the file system, the shell and the network, which is where an agent with system access does its damage. The audience is a developer or a small team that runs OpenClaw with real access to a machine.
Key Features and Architecture
AgentVault runs as a proxy between the agent and the machine it works on. The README lists six capabilities:
- Deep file system interception. It catches reads of sensitive files such as
~/.aws/credentialsand~/.ssh/id_rsa. - Dangerous command detection. It blocks
rm -rf, piping a download into a shell, and privilege escalation attempts. - Human-in-the-loop approvals. Every risky action waits for your explicit permission.
- Network monitoring. It logs all outbound connections and data exfiltration attempts.
- Audit trails. Every action is written to a SQLite database for later forensics.
- Real-time dashboard. A web UI shows what the agent is doing right now.
The README's worked example shows the approach: a malicious Google Doc tells the agent to send out SSH keys, and AgentVault blocks the file read and alerts you.
The tech stack is stated plainly. The proxy server is Node.js, TypeScript and Express. Monitoring uses deep file system hooks and command parsing. Audit logs are stored in SQLite, so you can query them with any SQLite client. The dashboard is built with Next.js 14 and Tailwind CSS and updates in real time. The repository holds src/, dashboard/ and demo-agent/ folders and an openclaw-wrapper.js file. Setup is three commands from the quick start: npm install -g agentvault, then agentvault wrap openclaw, then agentvault dashboard. Because a global npm install will sit between your agent and your credentials, check that the package you install is the one this repository publishes.
Two scope notes matter. First, the maker's launch description also names rate limiting and credential scanning, but the README does not describe either, so test them before you rely on them. Second, the README's roadmap lists VirusTotal skill scanning, a credential vault and Slack or email alerts as "shipping this weekend", and multi-agent monitoring, custom security policies and community threat intelligence sharing as "coming soon". With the last push on 2026-02-10, treat all of these as plans. Until custom policies arrive, you work with the detection rules the code ships with, and you wrap one agent at a time.
Ideal Use Cases
A solo developer running OpenClaw on a laptop or home server. If the agent can see your cloud keys and SSH keys, file interception on ~/.aws/credentials and ~/.ssh/id_rsa covers the exact theft paths the README cites. This is the best fit: one person, one agent, and the same person answering approval prompts.
A team of 2 to 5 engineers piloting an agent on a shared development server. The SQLite audit trail gives a record of every action, and the dashboard lets the team watch a run live. This works if one engineer owns the deployment and reads the code first.
Security engineers studying agent risk. The codebase is small enough to read end to end, and the MIT license lets you fork it and add your own rules. Even if you never deploy it, the "catch the action, not the prompt" design is a useful reference for your own tooling.
Don't use AgentVault if you need a production or regulated control. There are no releases, and the README states no support, security policy or compliance claims, which is a real gap for a security tool. It is also not a fit if your agents are not OpenClaw: the README only documents agentvault wrap openclaw. Teams that need agents to run unattended should also look elsewhere, because approval for every risky action means a person must be available. Finally, if you want to test LLM endpoints for weaknesses before release, that is a different job, covered under alternatives below.
Strengths & Trade-offs
AgentVault gets the main design choice right, but it is a first version, and the trade-offs come from that.
Pros
- It acts at the right layer. Blocking the file read, the command or the connection still helps after a prompt injection gets through.
- Its rules target concrete, documented theft paths:
~/.aws/credentials,~/.ssh/id_rsa,rm -rfand download-to-shell commands. - Every action lands in a SQLite file you own, which you can query, back up or export with standard tools.
- It is free under MIT and fully self-hosted, so no agent activity is sent to a vendor.
- The codebase is small enough to review in full before you trust it.
Cons
- It is early and quiet: 6 commits, 2 stars, no releases, and no push since 2026-02-10. The README still lists its "shipping this weekend" items as roadmap.
- The README documents OpenClaw only; other agents are not covered.
- Approval for every risky action can mean many prompts, and there are no custom policies yet to tune them.
- Rate limiting and credential scanning appear in the launch text but not in the README, so what is built is unclear.