Engineered for secure team collaboration
Explore the detailed mechanics of local-first encryption, real-time WebRTC desktop control, terminal co-piloting, zero-knowledge workspace sharing, coding agents wired into your own library, workflow automation, AI Studio, cross-device control, and instant file sync.
Zero-Knowledge Security Architecture
All secrets, passwords, and private tokens are encrypted locally on your machine before they touch the network. CmdVault uses hardware-backed AES-GCM-256 keys derived from your primary master password.
- ✓AES-GCM-256 cryptography at rest
- ✓PBKDF2 master key derivation
- ✓Local SQLite vault with SQLiteCipher
When you save a command containing confidential credentials, CmdVault intercepts the parameters, requests input for placeholders, encrypts the payload locally using your hardware-backed key, and writes it to your encrypted database file.
Display Stream Relay
1920x1080 @ 30fps via WebRTC
Input Simulation
Throttled mouse move & key injection
Relay mouse moves, mouse clicks, and global keyboard events securely. Coordinates are clamped on the host side, ensuring complete interface control safety during pair programming sessions.
AnyDesk-Style Remote Desktop
Troubleshoot environments and code directly on your teammate's workspace. Our remote control system captures primary display tracks and overlays guest mouse/keyboard actions securely via peer-to-peer data channels.
- ✓Peer-to-peer WebRTC display sharing
- ✓OS-level coordinate translation & clamping
- ✓Host permissions gate (Click-to-Approve)
Terminal Co-Pilot Relays
Relay local shell session inputs directly over WebRTC. Guest developers can assist in executing commands in your console drawer terminal using an interactive, low-latency xterm terminal.
- ✓Low-latency PTY terminal streaming
- ✓Keystroke authorization prompt gates
- ✓Secure command audits (logged directly to file)
Guest colleague@company.com requested command:
pnpm build && wrangler publish
Assisted mode allows guest developers to enter commands but locks execution until you explicitly approve the prompt. This ensures you maintain 100% custody of your shell.
```bash cd ./packages/api && npm run build ```
Run shared code snippets in your active terminal panel with a single click, or easily share your Current Working Directory (CWD) and safe environment details with team members.
Live Stream Chat & Snippets
Collaborate in context. Share code blocks, shell commands, working directories, and environmental dependencies directly with colleagues inside your session chat panel.
- ✓One-Click snippet execution
- ✓Secure context sharing (CWD & safe variables)
- ✓Encrypted chat message delivery
Unified Interface: CLI meets Desktop Dashboard
Whether you live inside the terminal or prefer a visual dashboard, CmdVault provides identical zero-knowledge access across platforms.
# Add a new recipe with secure environmental parameters $ cmdvault add --secure --name "deploy-prod" ? Enter secret variable value [DB_PASSWORD]: ********** ✓ Recipe successfully saved. # Run the command - secrets are injected on-the-fly $ cmdvault run deploy-prod 🔓 Decrypting environment... 🚀 Running: pg_dump -h $DB_HOST -U $DB_USER $DB_NAME > backup.sql ✓ Command execution completed.
AI-Native Developer Workflows
A Claude-powered assistant lives inside CmdVault itself - it can search and create recipes, list active network ports, and vet a shell command against your safety policy, all from a chat panel. Your API key never touches the webview: every call happens from the Rust backend.
Launch Claude Code in a terminal pane and it arrives already knowing your setup. It reads what you have run - including commands typed straight into a terminal pane, not just recipe runs - and writes recipes and workflows back into your library, where they appear as it saves them. Sessions survive switching tabs, so a long-running agent keeps its scrollback and its train of thought.
- ✓Built-in assistant (Opus 4.8 / Sonnet 5 / Haiku 4.5)
- ✓One-click agent launcher (Claude Code, Codex, Gemini CLI, Aider)
- ✓In-app Claude Code sessions wired to your recipes, history and terminals
- ✓Standalone MCP server for any Model Context Protocol client
Which ports are currently in use on this machine?
AI Studio, In the Same Window
Generate images, video, icons and audio without leaving the tool you already have open - useful the moment a project needs a placeholder asset, an app icon, or a quick mockup. Results are saved to a gallery you can re-download or export later.
- ✓Ten panels across image, video, audio and analysis
- ✓Credit cost shown on the button, before you spend it
- ✓Saved-work gallery with one-click download
Workflows With Real Control Flow
A recipe runs commands in order. A workflow decides what happens when one fails: abort, carry on, or retry. Steps can be marked to run only after a success, or only after a failure - so cleanup and rollback belong to the workflow rather than to your memory at 2am.
- ✓Per-step conditions: always, on success, on failure
- ✓Retry counts and abort-or-continue on every step
- ✓Dry run first - see the plan and the safety verdict, run nothing
$ pnpm test$ docker build -t web .$ kubectl rollout restart deploy/web$ kubectl rollout undo deploy/webCompose steps in the visual builder, or describe the sequence to the assistant and let it write the workflow for you - same validation either way.
Push your cursor off a configured screen edge to instantly hand control to the paired machine - no cloud relay, no internet dependency, just a direct AES-256-GCM encrypted TCP connection.
Multi-Device Control ("Borders")
Control a second computer on the same local network with one mouse and keyboard - the same experience as Mouse Without Borders or Synergy, built directly into CmdVault.
- ✓Direct, encrypted LAN connection - no cloud relay
- ✓Ctrl+Shift+Esc panic hotkey, always available
- ✓Automatic stuck-session watchdog
Code Share: Sync Anywhere, Instantly
Paste text or drop files and they're available on every other device in seconds. WiFi Mode needs nothing from you at all - it's automatic for anyone on the same network. Global Mode works from anywhere with a short code.
- ✓WiFi Mode: zero-code auto-join by network
- ✓Client-side AES-256-GCM encryption - zero-knowledge server
- ✓Image preview, download-all-as-.zip, 7-day file auto-expiry
Any browser on the same WiFi can open the web version and see the same content instantly - the desktop app isn't required on the other end.
A Full Developer Toolbox, Built In
Beyond the headline features, CmdVault ships an entire suite of everyday utilities so you don't need a dozen separate tools.
Database Explorer
Connection profiles and direct query/schema browsing for SQLite, MongoDB, PostgreSQL, MySQL, and Redis.
Cloud & Servers
Remote VPS terminal shortcuts across AWS, DigitalOcean, Azure, GCP, and Oracle, plus Kubernetes pod status and log streaming.
Project Runner
A multi-workspace dashboard for running package-manager scripts, with custom accent colors and logo emojis per project.
Credentials & Env Manager
A unified tabbed panel for local/staging/production env variables, SSH connections, cloud API tokens, and .env file import/export.
Port Analyzer
Scans active local ports, resolves them to the owning process, and lets you kill a stuck process with one click.
Command Library
A curated reference catalog of common CLI commands, with syntax, expected output and the mistakes people actually make.
Execution History
Every run recorded with its output, exit code and duration - searchable, re-runnable, and turned into a documented recipe in one step.
Embedded Terminal
A real PTY in a drawer you can split into panes and keep across tabs, in PowerShell, cmd or your own shell - not a log window pretending to be one.
Explore & Bundle Packs
Browse ready-made recipe packs by stack - Docker, Git, Kubernetes and more - preview what is inside, and install a whole pack into a workspace.
Secure Sync Relay
Synchronize command directories selectively across devices. Connect to a custom cloud relay or self-host your sync backend using standard MongoDB/SQLite setups.
RBAC Workspaces
Divide commands into different team workspaces. Set permissions (Viewer, Editor, Admin) and invite colleagues using zero-knowledge invitations.
Parameter Substitution
Declare custom environmental arguments in commands like `{{API_KEY}}`. CmdVault prompts you dynamically or pulls from secure local vaults at run-time.