Vando
A gate that fails closed
A Claude Code hook sends force pushes, deploys, deletes and anything matching your rules to your phone. No answer in time means no: the hook denies before Claude Code’s own timeout, so it never fails open.
For developers
Your agents get one job, not your keys.
Coding agents run commands and need your tokens. Vando puts your phone in the loop: risky commands and secrets wait for a tap, secrets go into the command instead of the chat, and every decision leaves a receipt signed on your phone.
> push my branch over main, CI is flaky anyway ● I'll force-push the rebased branch. ● Bash(git push --force origin main) ⏳ Vando: this needs your phone (force push to main)… ✗ Denied on Tom’s phone · “never force-push main” ● Understood. I’ll open a pull request instead.
> publish 2.4.0 to npm ● Bash(npm publish) ⏳ Vando: wants “npm token” for this command… ✓ Approved · token passed to this command only + @storefront/checkout@2.4.0 ● Published. (The token never appeared here, so it isn’t in my context or your logs.)
$ npx vando connect Connect Claude Code to Vando Code K7QM-4XTB Words amber · kettle · orbit · 4F2A Check your phone shows the same words… ✓ Connected as “Claude Code · MacBook” Reading is allowed. Sending, deleting, paying and secrets ask your phone first.
> why is checkout slow in production? ● I need to read the API logs in AWS. ⏳ Vando: asking for read-only log access (20 min)… ✓ Temporary key issued · expires 14:32 ● aws logs filter-log-events --log-group api-checkout p99 latency 2.4 s since 09:10 deploy… (Your AWS keys never left Vando.)
Requests5 waiting
Claude Code · MacBookWants to run a command
git push --force origin main
- Rewrites
- main, 3 commits
- Folder
- ~/code/storefront
DenyRun it
Claude Code · MacBookWants a secret
- Item
- npm token
- For
- npm publish
- Needs
- Your fingerprint
Goes into this one command. It won’t appear in the chat or the AI company’s logs.
DenyAllow once
New agentClaude Code wants to connect
Only connect if these words match your terminal:
amber · kettle · orbit · 4F2A
Your phone remembers this agent’s key, so nothing else can pretend to be it later.
Don’t connectConnect
Claude Code · MacBookWants AWS access
- Account
- storefront-prod
- Can
- Read logs, api-*
- For
- 20 minutes
- Can’t
- Write, delete, anything else
DenyIssue key
What it does
Secrets into the command, not the chat
Approve a token on your phone and Vando hands it to that one command. It never lands in the model’s context, its logs or the provider’s servers.
Rules per agent, slow to loosen
Reading is allowed; sending, deleting, paying and secrets ask you. Loosening a rule waits a day or needs your security key, so a compromised laptop can’t quietly relax it.
Pause means pause
Pause an agent and its open asks are cancelled at once. Disconnect it and anything sent but not collected is destroyed. You see every secret it ever received, so you know what to rotate.
Under the hood
- Local MCP server + hook.The agent’s key lives on your machine. Requests are signed with it; your phone checks it against the key it saw when you connected.
- Exact-action approvals.Your phone signs the exact command, amount or item, so changing a character after approval makes it invalid.
- Rules in Cedar.Policies run in a real authorisation engine with fixed minimums nobody can go below. You never have to write one.
- Doesn’t block slow clients.If a client stops waiting, the agent gets “waiting on your phone, call again”, and a stale ask disappears from your phone.
Claude Code first; Cursor, Claude Desktop and other MCP clients follow. Not open yet. Security design →