Previous Show HN: https://news.ycombinator.com/item?id=47136585. That version had the vault abstraction but access control lived entirely in application code — which is exactly the problem I was trying to solve.

This version adds server-side enforcement: access rules are declared via CLI and checked on every request, independent of what the agent implementation does. The boundary doesn't disappear if you write a bug.

Also added MCP server support, so Claude Desktop can use it with no integration code.