GDW Vault
ESGitHub

macOS · local vault · MCP server

Your connections.Under your control.

Manage SSH, SFTP, database, and web-service access from the menu bar. GDW Vault keeps secrets in the macOS Keychain and lets MCP-compatible assistants work with explicit controls.

InstallationView on GitHub

macOS 13+ · native Swift · v1.6.2

⌂This Mac
SQLite · groups and connections
Keychain · passwords and tokens
MCP over stdio · local XPC service
✳MCP client

01 — The product

A vault for your workflow.

Connections, credentials, and tools for working with infrastructure from a native macOS app.

01

Connections in one place

Organize groups and SSH, SFTP, FTP, MySQL, PostgreSQL, website, and API connections. Import sites from FileZilla.

02

MCP with per-operation controls

Use tools to query databases, run SSH commands, or call APIs. Security modes separate reading, editing, and destructive actions.

03

Secrets outside SQLite

Passwords and tokens are stored in the macOS Keychain. Sensitive operations ask for Touch ID or your Mac login password.

IncludesLocal MCPCLIFileZilla importerTouch ID

02 — Data and security

Every piece of data has its place.

GDW Vault separates connection metadata from secrets and keeps access to the store within your macOS session.

01 / Structure

Local SQLite

Groups, names, hosts, and connection settings live in the local database.

02 / Secrets

macOS Keychain

Passwords and tokens are stored as Keychain items, not as text in the SQLite database.

03 / Authorization

Touch ID

Reading secrets and sensitive operations require local authorization. Macs without Touch ID use the login password.

04 / Integration

Local MCP

Each MCP client communicates over stdio; SQLite queries go through the local XPC service.

Sync status

iCloud sync is disabled. Data is not automatically imported from or exported to the cloud.

Database transparency

SQLite contains connection metadata and is not encrypted by an application layer. macOS protects access to files in your account; secrets are stored separately in Keychain.

03 — How it works

From your vault to your MCP client.

Save connections

Create connections in GDW Vault or import a FileZilla sites.xml file. Secrets are stored in Keychain.

Configure the client

Add the GDW Vault executable and the --mcp argument to a compatible client.

Authorize operations

Choose tools and modes for the task. Sensitive reads and writes follow their authorization and confirmation controls.

For more information, visit the project repository.

View repository on GitHub

04 — Installation

Install GDW Vault on your Mac.

Install the universal app with Homebrew. You need macOS 13 or later and Homebrew.

Terminal · macOS

Install with Homebrew

v1.6.2
brew install --cask josecruzchavez/gdw-vault/gdw-vault

The cask installs the app, configures automatic startup and the local MCP service, and adds the gdw-vault command. Uninstalling preserves the database and Keychain. If Homebrew 7 asks you to trust the cask, run

brew trust --cask josecruzchavez/gdw-vault/gdw-vault and retry the installation.

You can also download the signed and notarized .pkg installer from the latest release; it installs the app and configures the service and CLI.

Download .pkg installerView downloads

05 — MCP integration

Connect your client, not your database.

Register GDW Vault as a local MCP server in VS Code or another compatible client. The menu bar app must be installed and active to provide the local service.

AI clients compatible with MCP

  • VS Code
  • Claude
  • OpenCode
  • DeepSeek
  • Cursor
  • Windsurf
  • Cline
  • Zed

Available tools

Connections and groups · SSH · MySQL/PostgreSQL · HTTP/API · secret delivery to local CLIs.

Security modes

Read · Info · Edit · Unsafe (with confirmation and local authorization).

Example configuration · mcp.json

{
  "servers": {
    "gdw-vault": {
      "command": "/Applications/GDW Vault.app/Contents/MacOS/GDW Vault",
      "args": ["--mcp"]
    }
  }
}

This path uses the default installation in /Applications. If your client uses a different configuration format, keep the same executable and --mcp argument.

06 — Frequently asked questions

Before you start.

Is GDW Vault free?

Yes. The app is completely free to download and use. If you would like to support the project, you can make an optional donation. Buy me a coffee

Does GDW Vault sync my data with iCloud?

No. iCloud sync is disabled; the database and Keychain are used locally on this Mac.

Can an AI assistant receive a password?

The get_connection_password tool can return a secret after local authorization. To keep it out of the chat response, run_with_secret can inject it into a local CLI through an environment variable or stdin and redact it from output.

Is the SQLite database encrypted?

It does not have application-level encryption. It stores connection metadata; passwords and tokens are stored separately in the macOS Keychain.

Does GDW Vault run on Windows?

No. The current app requires macOS 13 or later.

Can I download an already signed app?

Yes. Releases include a universal app signed and notarized by Apple in DMG and ZIP formats, plus a .pkg installer that automatically configures the service and CLI.

For more information, visit the project repository.

View repository on GitHub