Local AI Agents (Claude & Cursor)

Connect local MCP clients with short-lived delegated access and Human-In-The-Loop approvals.

This guide is for local AI assistants (Claude Desktop, Cursor, Windsurf, Cline) using Envault MCP.

Open execution layer, verifiable control

Envault runs a hybrid open-source model: the cloud control plane is proprietary, and the execution layer is fully auditable.

mcp-server/ is MIT-licensed and open source.
src/lib/sdk/ is MIT-licensed and open source.

Why this is a DX win:

You can audit the exact Human-In-The-Loop (HITL) interception path used by local agents.
You can inspect delegated token handling end-to-end, including the short-lived envault_agt_ JWT flow.
You can verify in code that agent mutation calls are routed into approval-first behavior, not silent file/database mutation.

We are accepting 5-10 free design partners to stress-test these paths. Try to break CLI flows, GitHub JIT onboarding, and HITL fencing, then send us repro steps.

When you run envault mcp install, Envault provisions a project-scoped delegated JWT (envault_agt_) with a 1-hour lifetime. The agent gets only scoped access for that project, not unrestricted account-wide access.

AI agents can read context, but mutations always require explicit human approval.

For manual client JSON configuration and full tools/security reference, see MCP Advanced Setup & Reference.

1. Setup for local development

Prepare your project

In your project root:

envault init
envault login

envault init maps the repo to the Envault project, and envault login establishes your secure user session.

Install MCP integration

For workspace-scoped setup (recommended):

envault mcp install --local

For machine-wide setup:

envault mcp install

Restart your AI client

Restart Cursor/Claude (or reload VS Code) so the MCP server initializes with the new delegated token.

2. How HITL approval works

When an AI attempts a mutation (for example: creating or updating a secret using envault deploy tools), Envault enforces Human-In-The-Loop:

The AI sends the mutation request through MCP.
Envault CLI intercepts and forwards the request to the Envault API using the delegated envault_agt_ JWT.
The API responds with 202 Accepted and creates a pending approval instead of executing immediately.
MCP surfaces a secure Approval Link back in your AI chat UI.
You open the link, review the exact proposed keys/values in the dashboard, and click Approve. Alternatively, you can approve from your terminal using envault approve <approval_id>, which now provides a visual cryptographic diff to prevent blind executions.
Envault then encrypts and applies the change.

Because the MCP server and SDK execution code are MIT-open, you can independently validate the delegated envault_agt_ minting and verification logic in your own review pipeline.

No approval means no mutation is executed.

3. Quick verification

After setup, ask your AI assistant to run a read operation (for example status/context). Then ask for a mutation and confirm you receive the approval link flow.

This validates both delegated auth and HITL controls in your local environment.

4. Install the Agent Skill (Cursor / Cline / Windsurf)

To ensure your AI agent understands Envault's HITL approvals and zero-hardcode rules, install the official Envault Agent Skill into your repository.

Run this at the root of your project:

npx skills add https://github.com/DinanathDash/Envault --skill envault

This pulls the official instructions into your local .agents/skills directory, preventing the agent from trying to bypass client-side encryption or getting stuck in retry loops during HITL approvals.

Local AI Agents (Claude & Cursor)

On this page