How SourceVault works

From a one-command install to a cited answer, the whole loop runs on your machine. Watch it in action, then see what each stage does.

Ask a question, get a cited answer, click straight to the source

A narrated 80-second session against a real repository: search, a question answered with file-and-line citations, the exact source behind a citation, pinned answers exporting to a runbook, watches re-checking themselves, and the index board that keeps every repo legible. Everything on screen runs locally.

The engine, step by step

Every question moves through four stages, all standard retrieval patterns implemented directly on ChromaDB and Ollama:

1. Hybrid retrieval combines semantic search and exact keyword matching on every query, then fuses the rankings so the strongest results rise to the top. Semantic-only search misses exact identifiers and keyword-only search misses paraphrased questions, so fusing both covers each one's blind spot.
2. Code-aware chunking splits files along function and class boundaries, so every result maps to readable code with exact line ranges. You never get a chunk that starts mid-function.
3. Context-aware embeddings carry each chunk's path and symbol names, so the vector store knows where code lives as well as what it says. "The auth middleware" finds middleware/auth.js even when the file never uses the word "middleware."
4. Grounded answers come last: Ask mode checks whether it has enough context, retrieves again if needed, and answers only from source-backed snippets instead of guessing. If the index can't support an answer, it says so.

Four commands cover it

Search for code, read a file, ask a question, ask the history. The commands behave the same way every time, whether you run them in the CLI, Telegram, or Hermes Desktop, which makes them easy to teach and support. You just ask; the engine handles retrieval.

The same engine is available over MCP to OpenClaw and any other MCP client, so every AI tool you run answers from the same private, cited index.

A session in the dashboard

Everything ships with a browser dashboard, so the whole team can use it without touching a terminal:

1. Sign in to GitHub, GitLab, or Bitbucket once. Browse and autocomplete your repositories as you type, and clone private repos without per-clone credentials.
2. Repositories index automatically on import. Update, sync, or switch branches per repo; a stale index is one click from fresh.
3. Search and Ask cover retrieval: literal and semantic search with file-type filters, plus Ask mode for grounded answers where every citation clicks open to its source. History and archive are built in.
4. Citations and search results open the full file in a syntax-highlighted viewer, with cited lines marked and scrolled into view. 15 languages, selectable light and dark code themes.
5. Set a watch to pin a question as a standing check. After every reindex it runs again and flags you if the cited answer has drifted. Useful for questions like "did the auth flow change this sprint?"

Governed agent access

Coding agents are useful because they read everything. That is also the problem: before you point one at a private repository, someone has to answer whether you can permit it, bind it, and prove afterwards exactly what the AI read. The SourceVault Gateway answers those questions, and it runs in the engine's data path rather than beside it.

A narrated 52-second walkthrough against the Express repository: retrieval working as usual, then a policy-guarded path absent from the results entirely, a credential scrubbed out of a file read, and the operator console verifying the audit chain. Everything on screen runs locally.

1. Sentinel matches repo-relative paths and either denies the read outright or returns the content redacted, with the reason you wrote in the rule. Denied paths also drop out of search results, so an agent cannot reach guarded code through retrieval either.
2. Every file read, search result, and answer goes through a gitleaks-style scan first. A key in a config file comes back as a redaction marker, before the content reaches the agent and therefore before a cloud-backed client could forward it to a model.
3. The dashboard, the MCP server, the HMAC machine API, and the Hermes plugin all call the same tool layer, so one policy evaluation governs them all and agent calls land in the same audit chain as everything else.
4. Each ask, search, file read, and policy decision appends one hash-chained record, anchored by a signed head, so truncation or deletion is detectable. The Gateway console reads that log back: agent activity by surface and repository, what was denied and redacted with the rule that fired, and whether the chain still verifies.

The Gateway is the Team and Enterprise differentiator, granted by a single license flag. Read the Gateway guide for the policy format, the audit-log contract, and the honest-use boundary.