SourceVault

Govern Claude Code in ten minutes

By the end of this page Claude Code reads your repository through a policy, under a name, with every read and every refusal in a hash-chained log you can export and report on. Ten minutes on a Mac or Linux machine; nothing leaves it.

On this page: install · turn the Gateway on · write a deny rule · name the agent · connect Claude Code · prove it · export and report · what to do next

1. Install and index one repository (3 minutes)

One command installs the engine and starts it as a service. The install is free forever on one repository, and the first seven days run the Gateway on that repository, so every step on this page works before you decide anything about a license.

# macOS (Homebrew); the Linux and Windows (WSL2) commands are on the install page
brew install sourcevault-ai/tap/sourcevault
brew services start sourcevault
sourcevault --version
#   sourcevault 1.58.3 (released 2026-10-10)

Open the dashboard at http://localhost:9000/dashboard/, sign in with the token the install printed, and add the repository you want governed: Repositories → Add, a clone URL or a local folder. Indexing runs in the background and the card shows progress. Lite mode, which needs no model download, is enough for everything below; search works, Ask declines until you pick a model under Settings → Engine.

2. Turn the Gateway on (1 minute)

Settings → Features. Switch on Audit log, Sentinel and Provenance. Each switch confirms its own save. Turning the audit log on is itself the first record it writes, so the chain never starts with a gap.

From a terminal, the chain already verifies:

sourcevault audit verify
#   2026-10: 2 records, intact, anchored by the signed head

3. Write a deny rule (2 minutes)

Sentinel reads policy.json from the state directory and picks up a change within seconds, no restart. The state directory is $(brew --prefix)/var/sourcevault/state on Homebrew and .sourcevault under the install directory elsewhere. This policy keeps private keys and secrets out of every agent's reach and leaves everything else readable:

cat > "$(brew --prefix)/var/sourcevault/state/policy.json" <<'EOF'
{
  "default": "allow",
  "rules": [
    { "match": ["**/*.pem", "**/*.key", "**/id_rsa*", "**/id_ed25519*"],
      "action": "deny", "reason": "private key material never leaves the engine" },
    { "match": [".env", ".env.*", "**/.env", "**/.env.*", "**/secrets/**", "**/*secret*", "**/*credential*"],
      "action": "deny", "reason": "secrets and credential files are out of scope for agents" }
  ]
}
EOF
chmod 600 "$(brew --prefix)/var/sourcevault/state/policy.json"

Rules are checked in order and the first match wins; deny refuses the read, redact returns a marker in place of the content, and the DLP pass scrubs secrets from every file an agent is allowed to read regardless of rules. The Gateway reference has the full rule grammar, including rules scoped to one repository or one agent.

The read tool refuses names the indexer ignores (.env itself, lockfiles, dependency directories) before Sentinel runs, so test a rule with a path that has a readable extension, such as config/secrets/app.json.

4. Give Claude Code a name (1 minute)

Without an identity, an agent's reads land in the chain as unattributed. A token binds a name to the surfaces and repositories it may use; the chain, the console and the report then say who asked. The plaintext is shown once and only its hash is stored, so keep it somewhere safe.

sourcevault agent mint claude-code --surfaces mcp
#   Minted agent "claude-code"
#     surfaces: mcp
#     repos:    all
#   Token (shown ONCE — only its hash is stored):
#     sva_…

Minting is itself audited, from the dashboard or the terminal. Scope a token to specific repositories with --repos backend,frontend; a scoped agent is refused at the door anywhere else, and the refusal is in the chain too.

5. Connect Claude Code (1 minute)

Register the MCP server once, carrying the token in its environment. The server starts only if the token is known, active and scoped to MCP; a wrong token makes it refuse rather than run unnamed.

claude mcp add --scope user sourcevault -e SOURCEVAULT_AGENT_TOKEN=sva_… -- sourcevault mcp
claude mcp get sourcevault
#   sourcevault: Status: ✔ Connected

From here every search_codebase, read_repo_file and ask_codebase call Claude Code makes passes the policy, is DLP-scrubbed before the content reaches the client, and is recorded under the name claude-code. The server's stdout carries only protocol frames; its log lines go to stderr. Details on the MCP server page.

6. Prove it (1 minute)

In a Claude Code session, ask it to use SourceVault to search the repository for something real, then to read a file under a denied path. The search succeeds; the read is refused with the rule's reason. Then look at what the chain holds:

sourcevault audit export --since "$(date +%Y-%m-01)" 2>/dev/null | tail -2
#   {"ts":"…","event":"search","via":"mcp","subject":"claude-code","repo":"backend","query":"authentication","results":2,"prev_hash":"…","hash":"…"}
#   {"ts":"…","event":"policy_decision","surface":"mcp","subject":"claude-code","op":"read","repo":"backend","file":"config/secrets/app.json","action":"deny","rule":"…","prev_hash":"…","hash":"…"}

The dashboard's Gateway view shows the same records aggregated: activity by agent and surface, the denial with its rule, and the chain verdict in plain language. Viewing it records nothing.

7. Export the chain and run the report (1 minute)

Two commands turn the records into evidence a security review can file. The export streams the chain to a SIEM in the format it takes; the report states, for a period, what AI read, what policy stopped, what changed in identity and configuration, and what AI wrote to the repository, with every number's source and how to reproduce it.

# lossless JSONL with the hash fields, or --format cef | syslog; exit 3 if a month fails verification
sourcevault audit export --since 2026-10-01 --out october.jsonl

# this quarter to date, as the document a reviewer reads
sourcevault report ai-activity --out q4-ai-activity.md

The sample report shows the full document for a quarter of real-looking activity. Both are also dashboard routes, documented on the Gateway reference.

What to do next