# Vault

A prompt-injection firewall for MCP that scans every tool response through four layers of detection before an agent reads it, wrapping any MCP server with no configuration change to the agent.

Vault is a proxy that sits in front of any MCP server and intercepts every tool response before an agent reads it, scanning it through four layers: a deterministic decoder, heuristics, embedding-similarity comparison, and a large-language-model judge. Wrapping a server needs no configuration change on the agent side; the agent is simply pointed at the proxy instead of the server directly. Without an API key, only the first two, offline layers run.

The project publishes reproducible measured performance figures from a harness committed in the repository: on a frozen public holdout set it reports a 100% true-positive detection rate with a 0% false-positive rate on benign documents when the language-model judge layer is enabled, and it documents per-layer latency, from roughly 0.02 milliseconds for the heuristic layer up to one to two seconds for the language-model layer, along with sustained throughput and memory figures under load.

It installs and runs through npx as a wrapper around an existing MCP server command.

Website: https://github.com/vaultmcp/vault