CmdVault Features Deep Dive

Engineered for secure team collaboration

Explore the detailed mechanics of local-first encryption, real-time WebRTC desktop control, terminal co-piloting, zero-knowledge workspace sharing, coding agents wired into your own library, workflow automation, AI Studio, cross-device control, and instant file sync.

Zero-Knowledge Security Architecture

All secrets, passwords, and private tokens are encrypted locally on your machine before they touch the network. CmdVault uses hardware-backed AES-GCM-256 keys derived from your primary master password.

  • ✓AES-GCM-256 cryptography at rest
  • ✓PBKDF2 master key derivation
  • ✓Local SQLite vault with SQLiteCipher
Raw CLI RecipeDB_PASS="super-secret"
Local EncryptionAES-256 Key
Secure Vault OutputU2FsdGVkX19G4...
How it works:

When you save a command containing confidential credentials, CmdVault intercepts the parameters, requests input for placeholders, encrypts the payload locally using your hardware-backed key, and writes it to your encrypted database file.

Remote Control Active
ATK3SU

Display Stream Relay

1920x1080 @ 30fps via WebRTC

Streaming

Input Simulation

Throttled mouse move & key injection

Assisted Mode
MacOS & Windows Supported:

Relay mouse moves, mouse clicks, and global keyboard events securely. Coordinates are clamped on the host side, ensuring complete interface control safety during pair programming sessions.

AnyDesk-Style Remote Desktop

Troubleshoot environments and code directly on your teammate's workspace. Our remote control system captures primary display tracks and overlays guest mouse/keyboard actions securely via peer-to-peer data channels.

  • ✓Peer-to-peer WebRTC display sharing
  • ✓OS-level coordinate translation & clamping
  • ✓Host permissions gate (Click-to-Approve)

Terminal Co-Pilot Relays

Relay local shell session inputs directly over WebRTC. Guest developers can assist in executing commands in your console drawer terminal using an interactive, low-latency xterm terminal.

  • ✓Low-latency PTY terminal streaming
  • ✓Keystroke authorization prompt gates
  • ✓Secure command audits (logged directly to file)
PENDING HOST APPROVAL

Guest colleague@company.com requested command:

pnpm build && wrangler publish
Assisted Authorization:

Assisted mode allows guest developers to enter commands but locks execution until you explicitly approve the prompt. This ensures you maintain 100% custody of your shell.

Relayed Chat StreamRoom Code: ATK3SU
Rohith A12:25 PM
Hey! Check out this setup script. You can run it directly:
```bash
cd ./packages/api && npm run build
```

Run shared code snippets in your active terminal panel with a single click, or easily share your Current Working Directory (CWD) and safe environment details with team members.

Live Stream Chat & Snippets

Collaborate in context. Share code blocks, shell commands, working directories, and environmental dependencies directly with colleagues inside your session chat panel.

  • ✓One-Click snippet execution
  • ✓Secure context sharing (CWD & safe variables)
  • ✓Encrypted chat message delivery

Unified Interface: CLI meets Desktop Dashboard

Whether you live inside the terminal or prefer a visual dashboard, CmdVault provides identical zero-knowledge access across platforms.

View Formats
# Add a new recipe with secure environmental parameters
$ cmdvault add --secure --name "deploy-prod"
? Enter secret variable value [DB_PASSWORD]: **********
✓ Recipe successfully saved.

# Run the command - secrets are injected on-the-fly
$ cmdvault run deploy-prod
🔓 Decrypting environment...
🚀 Running: pg_dump -h $DB_HOST -U $DB_USER $DB_NAME > backup.sql
✓ Command execution completed.

AI-Native Developer Workflows

A Claude-powered assistant lives inside CmdVault itself - it can search and create recipes, list active network ports, and vet a shell command against your safety policy, all from a chat panel. Your API key never touches the webview: every call happens from the Rust backend.

Launch Claude Code in a terminal pane and it arrives already knowing your setup. It reads what you have run - including commands typed straight into a terminal pane, not just recipe runs - and writes recipes and workflows back into your library, where they appear as it saves them. Sessions survive switching tabs, so a long-running agent keeps its scrollback and its train of thought.

  • ✓Built-in assistant (Opus 4.8 / Sonnet 5 / Haiku 4.5)
  • ✓One-click agent launcher (Claude Code, Codex, Gemini CLI, Aider)
  • ✓In-app Claude Code sessions wired to your recipes, history and terminals
  • ✓Standalone MCP server for any Model Context Protocol client
CmdVault Assistant

Which ports are currently in use on this machine?

Port 5432 is held by postgres, and 3000 by node. Want me to free one up?
What an in-app agent can reach:
ReadsRecipes, history, terminal panes, ports
SavesRecipes and workflows, documented
RunsCommands, with your approval each time
Assistant
Agents
MCP Server
Image generation
Video generation
Image editing
Icon generation
AI image detector
Lip sync
Image to prompt
Prompt improver
Audio generation
Every tool prices itself before you run itFirst one free

AI Studio, In the Same Window

Generate images, video, icons and audio without leaving the tool you already have open - useful the moment a project needs a placeholder asset, an app icon, or a quick mockup. Results are saved to a gallery you can re-download or export later.

  • ✓Ten panels across image, video, audio and analysis
  • ✓Credit cost shown on the button, before you spend it
  • ✓Saved-work gallery with one-click download

Workflows With Real Control Flow

A recipe runs commands in order. A workflow decides what happens when one fails: abort, carry on, or retry. Steps can be marked to run only after a success, or only after a failure - so cleanup and rollback belong to the workflow rather than to your memory at 2am.

  • ✓Per-step conditions: always, on success, on failure
  • ✓Retry counts and abort-or-continue on every step
  • ✓Dry run first - see the plan and the safety verdict, run nothing
Deploy webDry run
Run tests$ pnpm test
always
Build image$ docker build -t web .
retry ×2
Ship it$ kubectl rollout restart deploy/web
on success
Roll back$ kubectl rollout undo deploy/web
on failure
Built by hand or by the agent:

Compose steps in the visual builder, or describe the sequence to the assistant and let it write the workflow for you - same validation either way.

This Device
Paired Device
Security Key Connected
••••••••••••
Direct LAN Connection:

Push your cursor off a configured screen edge to instantly hand control to the paired machine - no cloud relay, no internet dependency, just a direct AES-256-GCM encrypted TCP connection.

Multi-Device Control ("Borders")

Control a second computer on the same local network with one mouse and keyboard - the same experience as Mouse Without Borders or Synergy, built directly into CmdVault.

  • ✓Direct, encrypted LAN connection - no cloud relay
  • ✓Ctrl+Shift+Esc panic hotkey, always available
  • ✓Automatic stuck-session watchdog

Code Share: Sync Anywhere, Instantly

Paste text or drop files and they're available on every other device in seconds. WiFi Mode needs nothing from you at all - it's automatic for anyone on the same network. Global Mode works from anywhere with a short code.

  • ✓WiFi Mode: zero-code auto-join by network
  • ✓Client-side AES-256-GCM encryption - zero-knowledge server
  • ✓Image preview, download-all-as-.zip, 7-day file auto-expiry
WiFi ModeGlobal Mode
Room ID5XZAJR
3
Type or paste text here to share across devices...
No app required:

Any browser on the same WiFi can open the web version and see the same content instantly - the desktop app isn't required on the other end.

A Full Developer Toolbox, Built In

Beyond the headline features, CmdVault ships an entire suite of everyday utilities so you don't need a dozen separate tools.

Database Explorer

Connection profiles and direct query/schema browsing for SQLite, MongoDB, PostgreSQL, MySQL, and Redis.

Cloud & Servers

Remote VPS terminal shortcuts across AWS, DigitalOcean, Azure, GCP, and Oracle, plus Kubernetes pod status and log streaming.

Project Runner

A multi-workspace dashboard for running package-manager scripts, with custom accent colors and logo emojis per project.

Credentials & Env Manager

A unified tabbed panel for local/staging/production env variables, SSH connections, cloud API tokens, and .env file import/export.

Port Analyzer

Scans active local ports, resolves them to the owning process, and lets you kill a stuck process with one click.

Command Library

A curated reference catalog of common CLI commands, with syntax, expected output and the mistakes people actually make.

Execution History

Every run recorded with its output, exit code and duration - searchable, re-runnable, and turned into a documented recipe in one step.

Embedded Terminal

A real PTY in a drawer you can split into panes and keep across tabs, in PowerShell, cmd or your own shell - not a log window pretending to be one.

Explore & Bundle Packs

Browse ready-made recipe packs by stack - Docker, Git, Kubernetes and more - preview what is inside, and install a whole pack into a workspace.

Secure Sync Relay

Synchronize command directories selectively across devices. Connect to a custom cloud relay or self-host your sync backend using standard MongoDB/SQLite setups.

RBAC Workspaces

Divide commands into different team workspaces. Set permissions (Viewer, Editor, Admin) and invite colleagues using zero-knowledge invitations.

Parameter Substitution

Declare custom environmental arguments in commands like `{{API_KEY}}`. CmdVault prompts you dynamically or pulls from secure local vaults at run-time.