VaultMorph Guard
VaultMorph Guard
Guard is an MCP server that sits between Claude Code CLI or Codex CLI and your filesystem. The agent reads and writes through Guard instead of directly — so a .env, an SSH key, or a customer export never reaches the agent's cloud LLM in real form.
Browser extensions that scan what you paste into ChatGPT assume a human types or pastes something. Coding agents read files, run commands, and call the model's API on their own — there's no paste step to scan.
A human copies a config value into a chat box, and a browser extension scans the field before it's sent. Useful — but it only covers content a person deliberately typed or pasted.
An agent debugging a deploy issue opens .env, greps a customer export, or catches an SSH key in a find output — mid-task, autonomously. Guard redacts it before the agent ever sees it.
| Layer | What it catches | Guarantee |
|---|---|---|
safe_read / safe_write |
Any file the agent chooses to read through Guard | Real values never enter the agent's context — the redaction layer |
Claude Code PreToolUse hook |
A raw Read/Edit/Write/Bash call bypassing Guard entirely | Model can't reason around it — runs outside the model. Best-effort only for Bash |
Codex CLI PreToolUse hook |
A raw shell/apply_patch/Edit/Write call bypassing Guard on the Codex CLI terminal |
Real enforcement once installed and trusted via /hooks — schema-tolerant rather than an exact-field guarantee like Claude Code's. Doesn't cover the desktop app's run-command feature |
| Git pre-commit scanner | A secret that made it into a file anyway, about to be committed | Courtesy layer — --no-verify bypasses it by design |
| Org policy (opt-in) | A developer disabling the hook locally | Centrally managed via managed-settings.json — a developer genuinely can't turn it off |
Security and compliance owners need a control they can point to. Developers need a tool that doesn't get in the way of the agent actually being useful.
AI coding agents already have filesystem and network access — Guard is the control that was missing between them.
On Claude Code, the hook can be centrally managed so no individual developer can disable it — "one policy, not per-developer configuration."
A locally-logged, AES-256-GCM encrypted event history (metadata only) an admin can review for compliance purposes.
Custom rule packs let you detect internal ticket formats, hostnames, or token shapes the bundled 127-rule set doesn't know about — without waiting on a vendor update.
Instead of banning agent access to sensitive files, Guard makes it safe to allow — agents stay useful, sensitive data stays off the wire.
No server to host, no account required — it activates itself, fully offline, on the developer's machine, free to use.
The agent still reads and edits the file — it just sees tokens instead of raw values, and real values are restored automatically on write.
npm install plus one registration command; a Community license generates itself offline on first run.
Standard MCP server — attaches to Claude Code CLI and Codex CLI the same way any other MCP server does.
The redact-on-read/restore-on-write round trip is free, indefinitely — no tier to navigate.
The docs state plainly where the guarantee is strong (Claude Code's hook) versus best-effort (Bash coverage, and Codex CLI's schema-tolerant hook) — no surprises when you rely on it.
The git pre-commit scanner and audit log tail catch what slips through, without waiting for someone else to notice.
Guard is a small tool by design — installation, admin setup, and day-to-day usage are covered together here rather than split across separate manuals.
npm install -g vaultmorph-guard claude mcp add vaultmorph-guard -- vaultmorph-guard
No account, no API key. A Community license generates itself automatically, fully offline, on first run.
npm install -g vaultmorph-guard vaultmorph-guard-setup
Registers Guard at --scope user, installs the PreToolUse hook into ~/.claude/settings.json, and points git's global core.hooksPath at Guard's pre-commit scanner. Safe to re-run any time.
Guard is a standard MCP server (stdio transport): codex mcp add vaultmorph-guard -- node /path/to/server.mjs.
node scripts/install-codex-hook.mjs /path/to/your/project
That registers Codex's own PreToolUse hook and sets [features] hooks = true in config.toml — then run /hooks inside a Codex CLI session to trust it. Codex won't execute an untrusted hook at all.
Once trusted, it's real enforcement on shell/exec, apply_patch, and file-tool calls — but schema-tolerant rather than an exact-field match, so treat it as a solid backstop, not an identical guarantee to Claude Code's hook. It only covers the CLI terminal: the Codex desktop app's built-in run-command feature doesn't route through it, so for now Guard's publicized support stops at the Codex CLI terminal.
Deploy via Claude Code's managed-settings.json with allowManagedHooksOnly: true — Claude Code then only runs hooks from the managed config; a developer's own project settings are silently ignored.
Rollback: delete or rename the managed-settings.json at the system path — the same host/admin access a developer doesn't have.
{
"pack_name": "acme-internal",
"rules": [{
"name": "Acme Ticket ID",
"regex": "\\bACME-[0-9]{6}\\b",
"type": "token",
"severity": "Medium"
}]
}
Default location: ~/.vaultmorph/guard/custom-rules.json, loaded automatically at startup if present. Always additive — never removes or weakens a bundled rule.
safe_read / safe_write — the core round trip. safe_search — grep with tokenized matches. guard_status — tier, rules version, session count. update_rules — signed rule updates. audit_log_tail — encrypted local event history.
PreToolUse hook once you install and trust it — but it's schema-tolerant rather than an exact-field match, so call it a real backstop, not an identical guarantee. Guard's publicized support is scoped to these two CLIs — GUI/desktop run-command features (including Codex's own desktop app) aren't covered by either hook.
No account, no API key, no infrastructure to stand up — free to use.